AI Agent UpdateCISA adds a Cisco firewall zero-day and a CVSS 10.0 GitLab flaw to KEV — both due Sunday, November 1
CISA added a Cisco firewall zero-day and a CVSS 10.0 GitLab flaw to its exploited-vulnerabilities catalog — both with a federal deadline of Sunday, November 1. That is a three-day fuse, and one of the fixes is trickier than it looks.
The News
CISA added two flaws to its Known Exploited Vulnerabilities catalog on October 29, both with a federal remediation deadline of Sunday, November 1 — a three-day fuse. The KEV catalog is the US government's list of flaws confirmed to be actively exploited; federal agencies must fix them by the deadline, and the rest of the industry treats the list as a patch-now queue. The catalog now stands at 1,764 entries. The first flaw, CVE-2026-76418, scored 8.6 out of 10, is a zero-day in Cisco Secure Firewall ASA and Secure Firewall Threat Defense: an unchecked return value leading to a NULL pointer dereference (CWE-690) in the Remote Access SSL VPN code, exploitable by an unauthenticated remote attacker when a tunnel group uses secondary authentication, forces the device to reload, taking it offline. A zero-day is a flaw attackers exploit before a fix exists. Cisco published fixes on October 28 and says there is no workaround, but it lists a short-term mitigation for operators that cannot upgrade today: turn off the tunnel-group list if DefaultWEBVPNGroup does not use secondary authentication, or remove secondary authentication (which weakens VPN login) as a stopgap — the software update remains the only fix.
The second flaw, CVE-2026-97229, scores the maximum 10.0. It is an integer overflow — a counting error — in the Onigmo regular-expression engine built into Ruby, reachable by an unauthenticated user through GitLab's CI/CD configuration processing to run code on the server. CI/CD is the automated pipeline that builds and tests software. GitLab patched it on October 12 in versions 19.2.8, 19.3.5 and 19.4.2, but the fix is subtle and worth the briefing's attention: Alpine Linux's October 28 post-mortem showed an attacker tried the flaw against Alpine's own GitLab server, and that upgrading GitLab alone did not close the hole on a standard-Ruby install — the Ruby update — versions 3.3.13, 3.4.12 and 4.0.9, released October 23, 11 days after GitLab's patches — was also required for installs running GitLab on their own Ruby. CISA warns other products using the same Ruby/Onigmo code may be affected.
This is distinct from the October 28 Fragnesia and VMware additions already published — these are two new entries, not a re-report. And the timing is the story: a three-day deadline over a weekend, for a firewall flaw with no workaround and a code-execution flaw whose fix has a hidden second step, is exactly how patch windows get missed. The GitLab entry carries a forensic triage requirement — meaning affected organizations should check whether they were already hit, not just patch and move on.
A three-day deadline over a weekend, a flaw with no workaround, and a fix with a hidden second step — this is how patch windows get missed.
Why It Matters
This matters because KEV deadlines are not advisory. Federal agencies face a binding Sunday deadline, and the private sector treats KEV as the definitive exploited-flaw list — insurers, auditors and incident responders all ask about it after a breach. A three-day fuse over a weekend compresses the hardest part of patching, which is not downloading the fix but finding every affected device, scheduling the change, and testing it. Firewalls and code-hosting servers are also the two systems an organization can least afford to take offline or get wrong.
The GitLab flaw's hidden second step is the deeper lesson. Software is built in layers — GitLab runs on Ruby, Ruby embeds Onigmo — and a fix at one layer does not automatically fix the layers beneath it. Alpine Linux, a sophisticated operator running its own GitLab server, discovered this the hard way when an attacker probed the flaw against them. If Alpine can miss the Ruby step, thousands of smaller GitLab operators will too. CISA's warning that other Ruby/Onigmo products may be affected widens the exposure beyond GitLab itself, and nobody yet has a complete list of those products.
The verdict is Bearish rather than neutral because both flaws are confirmed exploited, not theoretical. The Cisco flaw was exploited in the wild during October before its fix; the GitLab flaw drew a live probe against Alpine's server. Exploited flaws with weekend deadlines are how breaches happen — not through exotic zero-days, but through known flaws that organizations run out of week to fix. Sunday is the test of whether this week's warnings were heard.
Analyst's Take
The verdict is Bearish — for anyone exposed, not for Cisco or GitLab as companies. A maximum-severity code-execution flaw and a firewall zero-day, both confirmed exploited, both due in three days, are about as bad as a vulnerability week gets. The firewall flaw is the more urgent of the two: a device that can be forced offline by an unauthenticated request, with no workaround (a short-term mitigation exists for operators that cannot upgrade today), is a denial-of-service weapon pointed at network perimeters everywhere.
What to watch next is the Monday morning count: how many organizations met the November 1 deadline, and whether the GitLab flaw's hidden Ruby step leaves a tail of half-patched servers. The Alpine post-mortem is the warning — the organizations that only upgraded GitLab and skipped Ruby are still vulnerable, and attackers now know exactly which step gets skipped. If exploitation reports follow, they will follow that gap.
By The Numbers
FAQ
What is CISA's KEV catalog?
The Known Exploited Vulnerabilities catalog is the US government's list of security flaws confirmed to be actively exploited. Federal agencies must fix listed flaws by the stated deadline — and everyone else treats the list as a patch-now priority queue.
What does CVSS 10.0 mean?
CVSS is a 0-to-10 severity score for vulnerabilities. A 10.0 is the maximum: the worst combination of easy exploitation and severe impact. The GitLab flaw scores 10.0; the Cisco flaw scores 8.6.
What is a zero-day?
A flaw that attackers are exploiting before the vendor has a fix available — the defenders have had 'zero days' to prepare. Cisco's firewall flaw was exploited in the wild before its October 28 fix.
Why is the GitLab fix subtle?
GitLab patched the flaw on October 12, but the bug lives in the Onigmo code inside Ruby, the programming language GitLab runs on. Alpine Linux's post-mortem showed that upgrading GitLab alone did not close the hole on standard-Ruby installs — the Ruby update (versions 3.3.13, 3.4.12 and 4.0.9, released October 23) was also required for installs running GitLab on their own Ruby.
What should organizations do before Sunday?
Apply Cisco's October 28 firewall update — there is no workaround, but a short-term mitigation exists for operators that cannot upgrade today (turn off the tunnel-group list if DefaultWEBVPNGroup does not use secondary authentication, or remove secondary authentication as a stopgap) — and confirm both the GitLab version and the underlying Ruby version are patched. CISA also warns other products using the same Ruby/Onigmo code may be affected, so inventory those too.
👁
Source: Carthage Electronics CVE Threat Brief