CISA Adds GitLab RCE and Cisco DoS Flaws to KEV List

Introduction

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog by adding two newly identified security flaws that are currently being actively exploited in the wild. One of these vulnerabilities affects GitLab, a widely used DevOps platform, while the other impacts Cisco networking hardware commonly deployed in enterprise firewall environments. Both flaws pose significant risks to organizations relying on these technologies for critical infrastructure and development workflows.

GitLab RCE Vulnerability: CVE-2026-97229

The first vulnerability added to the KEV list is an integer overflow or wraparound issue designated as CVE-2026-97229. This flaw impacts both the Community Edition and Enterprise Edition of GitLab. With a CVSS score of 10.0, this vulnerability represents a critical-severity remote code execution (RCE) risk. Exploitation could allow attackers to execute arbitrary commands on affected systems, potentially leading to full system compromise. Given GitLab's role in software development pipelines, successful exploitation may result in unauthorized access to source code repositories, CI/CD processes, and sensitive project data.

Cisco Firewall DoS Vulnerability

The second vulnerability pertains to denial-of-service (DoS) conditions affecting Cisco firewall products. While specific technical details such as CVE identifiers and affected models were not disclosed in the source material, CISA has confirmed evidence of active exploitation. DoS vulnerabilities can disrupt network availability by causing devices to crash or become unresponsive, which can severely impact business continuity and security monitoring capabilities. Organizations using Cisco firewalls should assess their exposure and apply vendor-recommended updates promptly.

Who Is Affected and Why It Matters

Enterprises utilizing GitLab for version control and DevOps automation are at heightened risk due to the critical nature of the RCE vulnerability. Similarly, organizations relying on Cisco firewalls for perimeter defense may face service disruptions if the DoS flaw is exploited. Since both vulnerabilities are listed in the KEV catalog, federal agencies are required to remediate them within strict timelines. However, private sector entities should also treat these issues with urgency, as attackers often leverage known exploited vulnerabilities to gain initial access or escalate privileges within compromised networks.

What Readers Should Do Now

Security and IT teams should take the following actions immediately:

• Review affected systems: Identify all instances of GitLab CE and EE within your environment and verify whether they are running vulnerable versions.
• Apply patches: Download and install the latest security updates from GitLab and Cisco as soon as they are available.
• Monitor for signs of compromise: Use SIEM or EDR solutions to detect unusual activity that may indicate prior exploitation attempts.
• Implement network segmentation: Limit communication between critical services and reduce potential attack surface.
• Update incident response plans: Ensure your team understands how to respond quickly to similar incidents in the future.

Conclusion

By adding these two vulnerabilities to its KEV catalog, CISA is signaling that immediate action is necessary across public and private sectors. Proactive identification and remediation of exploited flaws remain essential components of any robust cybersecurity strategy. Grivyonx Technologies supports organizations in strengthening their defenses through AI-driven automation, integrated DevSecOps practices, and scalable cloud security solutions designed to keep pace with evolving threats.