CISA Reports Critical Security Vulnerabilities in GitLab and Cisco

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security-related vulnerabilities in software products from GitLab and Cisco to its Known Exploited Vulnerabilities (KEV) list on October 27, 2026. This decision is based on evidence of active exploitation of these vulnerabilities in the cyber landscape. The first vulnerability, identified as CVE-2026-97229, affects both the GitLab Community Edition and the Enterprise Edition.

This vulnerability is rated with a maximum CVSS score of 10.0, making it one of the most critical vulnerabilities currently known. The vulnerability results from an integer overflow or wraparound, allowing attackers to execute potentially harmful code. The second vulnerability affects Cisco firewall products and leads to a Denial-of-Service (DoS) vulnerability. This flaw could enable attackers to overload the firewall, thereby interrupting access to networks. CISA has detailed the affected products and versions in its alerts to assist companies in securing their systems.

CISA has urgently urged businesses and organizations to install the relevant security updates to protect against potential attacks. The agency has also recommended regularly checking systems for the latest security updates and ensuring compliance with all security policies. The active exploitation of these vulnerabilities poses a significant risk to companies relying on the affected software solutions. Security researchers have already published reports of attacks exploiting these vulnerabilities, underscoring the urgency of the issue. CISA has previously taken similar actions to raise awareness of critical security vulnerabilities.

Inclusion in the KEV list is an important step in drawing attention to the need for security updates and helping companies protect their systems. Affected companies are urged to review their security protocols and make adjustments as necessary to minimize the impact of these vulnerabilities. CISA has also provided resources to assist companies in identifying and addressing these security vulnerabilities. The CVE-2026-97229 vulnerability is not the only critical security flaw identified in recent months. The increase in such vulnerabilities highlights the challenges companies face in the field of cybersecurity.

According to CISA, over 150 new vulnerabilities have already been added to the KEV list in 2026. CISA plans to provide further information and updates on these vulnerabilities to assist companies in ensuring their network security. The agency has emphasized that collaboration between government and the private sector is crucial to strengthening cyber defense. The CVE-2026-97229 vulnerability reportedly affects a wide range of users globally, further increasing the urgency for security updates. Companies should take immediate action to protect their systems and ensure the integrity of their data.