Critical GitLab and Cisco flaws exploited; KEV catalog listing demands urgent patching

En bref

• Two 2026 flaws affect software from GitLab and Cisco.
• CVE-2026-97229 can enable code execution.
• Attackers are already using the flaws.
• A KEV catalog listing raises remediation priority.

In 2026, defenders are tracking a pair of security defects in software from GitLab and Cisco. One is identified as CVE-2026-97229. The flaws can lead to code execution, and attackers have begun using them rather than waiting for normal patch cycles to close the exposure.

The Known Exploited Vulnerabilities catalog listing changes the priority. A KEV entry is not a theoretical warning; it signals that exploitation is known and that remediation should move faster than routine maintenance. For school IT teams, the listing should trigger an immediate review of exposed instances, patch status, and compensating controls.

GitLab and Cisco products often sit in development, collaboration, and network paths. A code-execution bug in either vendor's software can give an intruder a foothold that is hard to detect when logging and segmentation are weak. Risk is highest where internet-facing services are unpatched or where administrative interfaces are broadly reachable.

Because two flaws are involved, administrators should not assume that fixing CVE-2026-97229 closes the entire exposure. Inventory both GitLab and Cisco assets, verify versions, and apply vendor guidance. Where patching cannot happen immediately, reduce attack surface and monitor for exploitation attempts.

What to watch: vendor advisories, KEV updates, and signs of unusual process creation or outbound connections on GitLab and Cisco hosts. In a K-12 environment, prioritize internet-facing systems and any platform that handles source code, credentials, or network configuration.

À faire maintenant

1. Immediately inventory all GitLab and Cisco software instances, including internet-facing and administrative interfaces; record versions and owners.
2. Apply vendor patches or mitigations for CVE-2026-97229 and the second flaw; prioritize internet-facing systems and those with privileged access.
3. Restrict management interfaces and GitLab/Cisco admin access to trusted networks or VPN; enforce MFA where supported.
4. Review logs for exploitation indicators around affected services; enable verbose logging and alert on suspicious process, file, or outbound network activity.
5. If patching is delayed, isolate or temporarily disable affected services, and block known malicious indicators from vendor and KEV guidance.
6. Validate backups and incident response contacts; prepare to rotate credentials and secrets if compromise is suspected.
7. Track KEV catalog and vendor advisories daily until remediation is complete; document exceptions with risk acceptance.

Références CVE

• CVE-2026-97229

Source originale

Security Affairs