Actively Exploited GitLab and Cisco Firewall Vulnerabilities: What UK Teams Need to Know

The US Cybersecurity and Infrastructure Security Agency has added two new vulnerabilities to its Known Exploited Vulnerabilities catalogue following confirmed evidence of active exploitation. As reported by The Hacker News, the first is CVE-2026-97229, an integer overflow vulnerability in GitLab Community Edition and Enterprise Edition that carries a maximum CVSS score of 10.0 and enables remote code execution. The second is CVE-2026-76418, affecting Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, which can be exploited to trigger a denial of service condition. Both products are widely deployed across UK enterprise, public sector, and managed service provider environments.

Why this matters for UK organisations

GitLab is used by a large number of UK development teams as the foundation for source code management, CI/CD pipelines, and DevOps workflows. A remote code execution vulnerability at this severity level means that an unauthenticated attacker who can reach a GitLab instance could potentially gain full control of the platform, exposing source code repositories, pipeline secrets, deployment credentials, and access tokens that could be used to pivot into wider infrastructure. The risk is not limited to the GitLab instance itself: a compromised CI/CD pipeline can introduce malicious code into software builds, creating a supply chain risk that extends to customers and end users. The Cisco Firewall vulnerability is equally significant for organisations that rely on ASA or FTD appliances as a primary perimeter control, where a denial of service condition could disrupt network security monitoring and connectivity. The KEV listing confirms that both vulnerabilities are being actively exploited, not merely theoretically possible.

What to review

UK organisations should immediately confirm which versions of GitLab CE, GitLab EE, Cisco Secure Firewall ASA, and Cisco Secure FTD are deployed across their environments and verify whether vendor patches are available and applied. Where patching cannot be completed immediately, teams should assess what compensating controls, such as network segmentation, access restrictions, or enhanced monitoring, can reduce exposure in the interim. It is also worth reviewing access logs on GitLab instances and firewall appliances for any anomalous activity over the past several weeks. Organisations that use GitLab as part of a CI/CD pipeline should consider whether a review of recent pipeline runs and build artefacts is warranted to confirm integrity.

Source: The Hacker News