CISA Flags Actively Exploited GitLab RCE (CVSS 10.0) and Ivanti VPN Flaws — Patch the Edge First

CISA adds GitLab RCE CVE-2026-97229 (CVSS 10.0), a Cisco firewall DoS and two Ivanti VPN flaws to KEV. What K-12 IT teams must patch now.

• CISA added CVE-2026-97229, a GitLab remote code execution flaw with a CVSS score of 10.0, and a Cisco firewall denial-of-service flaw to its Known Exploited Vulnerabilities catalog on Thursday, citing evidence of active exploitation.
• In a separate advisory dated 2026-10-30 (Friday), CISA added two Ivanti Connect Secure flaws — CVE-2026-111357 (missing authentication for a critical function) and CVE-2026-118527 (generation of predictable values) — the VPN appliances many districts rely on for remote staff access.
• KEV listing means exploitation is happening now, not theoretically: internet-facing GitLab, Ivanti and firewall management interfaces are the priority, and patched appliances should still be treated as possibly compromised.

What to do now

1. Inventory today: every GitLab Community/Enterprise Edition instance, every Ivanti Connect Secure appliance and every Cisco firewall management interface — record version, build, owner and whether it is reachable from the internet.
2. Apply the vendor fixed release or prescribed mitigation immediately for CVE-2026-97229, CVE-2026-111357 and CVE-2026-118527; pull the Cisco CVE identifier from the KEV catalog and apply that fix too. Do not wait for a maintenance window.
3. Remove exposure: put GitLab, Ivanti and firewall admin interfaces behind VPN or an IP allowlist, enforce MFA, and disable any service that is not operationally required.
4. Hunt logs for the past 7–14 days: unexpected process execution, new admin accounts, CI/CD variable or deploy-key changes on GitLab; anomalous authentication, new accounts and configuration edits on Ivanti; outage or restart patterns on firewalls. Preserve logs before patching.
5. Assume credential exposure on any affected appliance: rotate admin passwords, API keys, session tokens and secrets stored in CI/CD, then verify backups and incident response contacts before you need them.

Related items

• PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
• CISA Adds Two Known Exploited Vulnerabilities to Catalog
• Fresh WordPress Vulnerability in Attackers Crosshairs
• WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
• CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
• Fake IT help desk callers got by on little more than names and email addresses
• WordPress doesn’t ship Brotli. It’s still exposed to CVE-2026-111497
• U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog