CISA flags max-severity GitLab and Cisco flaws under active exploitation

Key points

• CISA added two flaws to KEV in a Thursday 2026 update.
• One issue is tracked as CVE-2026-97229; the maximum CVSS score is 10.0.
• Affected products include GitLab Community Edition, GitLab Enterprise Edition and Cisco firewall.
• Reported risks include remote code execution, denial of service and active exploitation.
• K-12 administrators should inventory exposed instances and mitigate urgently.

CISA moved a pair of vulnerabilities onto its Known Exploited Vulnerabilities catalog in a Thursday 2026 update, saying it has evidence that attackers are already leveraging them. One of the issues is tracked as CVE-2026-97229. The two flaws reach a maximum CVSS score of 10.0 and involve GitLab Community Edition, GitLab Enterprise Edition and Cisco firewall products. The reported consequences include remote code execution and denial of service, with active exploitation confirmed by the agency.

That combination is serious for school districts and state education agencies. GitLab installations often hold source code, pipeline secrets and internal project data, while Cisco firewalls sit at network boundaries. A successful remote code execution attack could give an intruder a foothold for deeper access; denial-of-service activity could interrupt services that staff and students depend on. Because exploitation is already occurring, waiting for a routine maintenance window is not appropriate.

The KEV listing is a strong signal. It means CISA has cited exploitation evidence, not merely theoretical risk. Federal agencies face remediation timelines under the catalog, but K-12 and other public-sector organizations should apply the same urgency. A CVSS score of 10.0 leaves little room for triage delays, especially when the affected products are internet-facing or support critical workflows.

Administrators should watch vendor advisories for GitLab and Cisco, confirm which instances are exposed, and monitor for unusual process execution, unexpected service outages or suspicious firewall activity. They should also track CVE-2026-97229 and related guidance as details evolve. The key question is not whether the flaws are dangerous, but whether every affected system has an owner, a mitigation plan and a way to detect exploitation.

What to do now

1. Inventory all GitLab Community Edition, GitLab Enterprise Edition and Cisco firewall instances, including internet-facing and departmental deployments.
2. Apply vendor-provided updates or mitigations as soon as they are available; if fixes are not yet available, restrict access to affected systems.
3. Reduce attack surface by removing unnecessary internet exposure and enforcing VPN, allowlists or other access controls.
4. Review GitLab and firewall logs for exploitation indicators, unexpected process execution, service outages or suspicious administrative activity.
5. Isolate or shut down unsupported or unpatchable instances until remediation can be completed.
6. Verify backups and incident response contacts, and preserve logs if compromise is suspected.
7. Track CVE-2026-97229 and KEV guidance closely, and report confirmed incidents through appropriate incident response channels.

CVE references

• CVE-2026-97229

Original source

The Hacker News