Two widely used platforms, GitLab and Cisco ASA, both received CISA Known Exploited Vulnerabilities catalog additions this week, and federal civilian agencies face a November 1 remediation deadline for both. GitLab's CVE scores a perfect 10.0. Cisco's affects a product that is often the first thing between the internet and a corporate network. Neither is a theoretical risk.
GitLab CVE-2026-97229: a CVSS 10.0 regex compiler flaw
CVE-2026-97229 is an integer overflow in the Onigmo regex compiler that GitLab uses to process regular expressions in CI/CD pipeline configurations and project settings. A specially crafted regular expression triggers an overflow that corrupts heap memory and leads to remote code execution. The vulnerability is exploitable without authentication on self-managed GitLab instances that expose their web interface. GitLab.com was patched before the disclosure. Self-managed installs running versions below 17.4.2, 17.3.5, or 17.2.9 remain vulnerable.
A CVSS 10.0 score requires maximum impact across confidentiality, integrity, and availability with no authentication required, no user interaction, and a network attack vector. CVE-2026-97229 meets all of those criteria. In practice, exploitation gives an attacker the ability to inject arbitrary code into the CI/CD pipeline, exfiltrate secrets and repository contents, and pivot to production environments that pull from the compromised instance. For organizations that use GitLab as the gatekeeper for their software supply chain, this is a critical exposure.
Cisco ASA CVE-2026-76418: SSL VPN zero-day under active exploitation
CVE-2026-76418 is a denial-of-service vulnerability in Cisco's Adaptive Security Appliance and Firepower Threat Defense SSL VPN. A remote attacker can send a crafted sequence of packets to the SSL VPN listener that causes the device to reload. Cisco confirmed active exploitation of this zero-day in the wild before patches were available. The CVSS score is 8.6. The practical severity for organizations that depend on Cisco ASA for remote access is higher: an attacker who can reliably bring down the VPN concentrator can block access or use the disruption as cover for other activity.
Cisco released patched ASA software in version 9.18.4.67 and later. FTD patches are available in the corresponding 7.x release trains. Devices running interim versions without the fix are vulnerable to repeated reload attacks with no traffic-based mitigation short of blocking the SSL VPN listener entirely, which defeats the purpose of the appliance.
The November 1 deadline and what it means
BOD 26-04 requires federal civilian executive branch agencies to remediate KEV-listed vulnerabilities within defined windows. Both CVE-2026-97229 and CVE-2026-76418 received a November 1 deadline, meaning agencies have until the end of that day to apply patches or implement compensating controls. The deadline is two days from today.
The FCEB mandate does not extend to private sector organizations, but the signal is the same: both CVEs are being actively exploited now. GitLab self-managed instances should be upgraded this weekend. Cisco ASA and FTD devices should be patched or scheduled for the next maintenance window with urgency, not the next quarterly cycle. If you use Cisco ASA for remote access and cannot patch immediately, review whether any upstream filtering can block the specific packet pattern Cisco's advisory describes as the trigger.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need to assess your exposure to these CVEs or prioritize remediation across your environment.