On October 29, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild:
- CVE-2026-97229 — An Integer Overflow or Wraparound vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE)
- CVE-2026-76418 — An Unchecked Return Value leading to NULL Pointer Dereference in Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software
A KEV listing is not a theoretical warning. It is CISA telling you, with the weight of federal incident data behind it, that adversaries are exploiting these flaws right now against real targets. One bug sits on your source code and CI/CD crown jewels; the other sits on your network perimeter. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies have hard remediation deadlines tied to KEV entries — but every organization running these products should treat this as a drop-everything patching event.
Technical Analysis
CVE-2026-97229 — GitLab CE/EE Integer Overflow or Wraparound
Integer overflow and wraparound flaws (CWE-190) occur when an arithmetic operation produces a value that exceeds the storage capacity of the integer type, causing the value to wrap. In a platform like GitLab — which processes user-supplied input across repository operations, API calls, file handling, and CI/CD pipeline processing — a wraparound can corrupt size calculations for memory allocation or bounds checks. The practical consequence is typically a heap or buffer under-allocation followed by an out-of-bounds write or read, which is the classic primitive chain toward remote code execution or, at minimum, a crash of the GitLab service (Puma/Workhorse/Rails).
Defender-relevant exploitation characteristics:
- Attack surface: Network-accessible GitLab web interface and API (TCP 80/443, or your configured port). Self-managed instances are the primary exposure; GitLab.com SaaS is patched by GitLab directly.
- Exploitation vector: Crafted requests to GitLab components with attacker-controlled size/length parameters. Expect abnormally large or boundary-value integer fields in POST bodies, API parameters, or file upload headers.
- Post-exploitation behavior: If code execution is achieved, the attacker's first moves typically involve spawning a shell or dropping a payload from the GitLab service context — watch for
gitlab-workhorse,puma, orgitalyspawning unexpected child processes, or outbound connections from the GitLab host to non-corporate infrastructure.
CVE-2026-76418 — Cisco Secure Firewall ASA / Secure FTD NULL Pointer Dereference
This vulnerability (CWE-476 / CWE-252 class) stems from an unchecked return value: the software fails to validate the result of a function call, and a subsequent operation dereferences a NULL pointer. On a network security appliance, the most reliable outcome of NULL pointer dereference is a crash of the affected process or an unsolicited device reload — in other words, denial of service against your perimeter firewall. Depending on code path and memory layout, dereference primitives can in some cases be leveraged further, but defenders should first assume the impact scenario adversaries are exploiting: crashing or destabilizing the inspection and VPN services that protect your edge.
Defender-relevant exploitation characteristics:
- Attack surface: Cisco ASA and FTD devices running affected software trains. Any interface-exposed service that parses attacker-influenced input (web services, VPN termination, inspection engines) is candidate exposure.
- Observable impact: Unexpected reloads, watchdog crashes, core dumps written to flash,
%ASA-1-/%FTD-1-severity syslog messages, and traceback output inshow crashinfo. Repeated short-interval reloads of a perimeter firewall is a top-priority incident indicator, not a hardware fluke, until proven otherwise.
Exploitation Status
Both CVEs are listed in the CISA KEV Catalog as of October 29, 2026, which means CISA has verified active exploitation. Under BOD 26-04 (Prioritizing Security Updates Based on Risk), FCEB agencies must remediate KEV-listed vulnerabilities within the directive's mandated timelines. Private-sector organizations should adopt the same urgency — KEV-listed edge-device and DevOps-platform vulnerabilities have historically been precursors to ransomware initial access and espionage campaigns.
Detection & Response
Exploitation of both flaws is network-triggered, but post-exploitation and impact artifacts are observable at the host and appliance level. The detections below focus on high-fidelity behaviors: anomalous process spawning from GitLab service parents, and crash/reload telemetry from Cisco firewalls.
Sigma Rules
---
title: GitLab Service Spawning Suspicious Child Process
id: 3f9c1a72-8b4e-4d21-a967-2c5e6f7a8b9d
status: experimental
description: Detects GitLab core service processes (Puma, Workhorse, Gitaly, Rails) spawning shells or scripting interpreters, consistent with post-exploitation activity following remote code execution against GitLab CE/EE such as CVE-2026-97229.
references:
- https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/30
tags:
- attack.initial_access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- '/opt/gitlab/'
- 'gitlab-workhorse'
- 'puma'
- 'gitaly'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/python'
- '/python3'
- '/perl'
- '/curl'
- '/wget'
- '/nc'
- '/ncat'
condition: selection_parent and selection_child
falsepositives:
- Legitimate GitLab maintenance tasks, backup scripts, and administrative shells executed under service parents
level: high
---
title: Web Request With Abnormally Large Integer Parameter to GitLab
id: 6e2b4d81-1a3c-4f58-b2d4-9e7a5c6d8f21
status: experimental
description: Detects inbound HTTP requests to GitLab instances containing integer fields near or exceeding 32-bit/64-bit boundaries in the query string or body, consistent with probing for integer overflow conditions such as CVE-2026-97229.
references:
- https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog
- https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/30
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
product: linux
detection:
selection:
cs-uri-query|contains:
- '2147483647'
- '2147483648'
- '4294967295'
- '4294967296'
- '9223372036854775807'
- '18446744073709551615'
- '0x7fffffff'
- '0xffffffff'
condition: selection
falsepositives:
- Security scanners and authorized penetration testing
- Rare legitimate API usage with large identifiers
level: medium
---
title: Cisco ASA/FTD Unexpected Reload or Crash Event
id: 8a1d5e63-4b7c-4a92-d6f3-1e8b9c2a5d47
status: experimental
description: Detects syslog evidence of crash, traceback, or unexpected reload events on Cisco ASA/FTD devices, a key observable for exploitation of NULL pointer dereference vulnerabilities such as CVE-2026-76418.
references:
- https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog
- https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/10/30
tags:
- attack.impact
- attack.t1499
- attack.initial_access
- attack.t1190
logsource:
category: firewall
product: cisco
detection:
selection_msg:
Message|contains:
- 'crashinfo'
- 'Traceback'
- 'watchdog'
- 'unexpected reload'
- 'System reload'
selection_sev:
Severity:
- 1
- 2
condition: selection_msg and selection_sev
falsepositives:
- Planned maintenance reloads and hardware faults (correlate with change tickets)
level: high
KQL — Microsoft Sentinel Hunt
This query hunts across ingested firewall/syslog telemetry (CEF or Syslog) for Cisco crash indicators, and across Linux process telemetry for GitLab service abuse:
// Part 1: Cisco ASA/FTD crash and reload indicators (CVE-2026-76418)
let crashIndicators = dynamic(["crashinfo", "Traceback", "watchdog", "unexpected reload", "System reload"]);
let ciscoEvents = union isfuzzy=true
(CommonSecurityLog
| where DeviceVendor =~ "Cisco"
| where Message has_any (crashIndicators)
| project TimeGenerated, SourceIP, DeviceName, DeviceProduct, Message, LogSeverity),
(Syslog
| where Facility =~ "local4" or Computer has_any ("asa", "ftd", "fw")
| where SyslogMessage has_any (crashIndicators)
| project TimeGenerated, Computer, HostIP, SyslogMessage, SeverityLevel);
ciscoEvents
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, Computer, Message, SyslogMessage
| order by EventCount desc;
// Part 2: GitLab service spawning shells or download tools (CVE-2026-97229)
// Run separately in environments ingesting Linux auditd/Sysmon-for-Linux into SecurityEvent or via AMA
SecurityEvent
| where TimeGenerated > ago(7d)
| where ParentProcessName has_any ("gitlab-workhorse", "puma", "gitaly")
or CommandLine has_any ("gitlab-workhorse", "puma", "gitaly")
| where Process has_any ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat")
or NewProcessName has_any ("/bin/sh", "/bin/bash", "/usr/bin/curl", "/usr/bin/wget")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated desc
Velociraptor VQL
For rapid triage of a GitLab server after suspected exploitation, hunt for shells and staging activity under GitLab service parents and for recently modified files in GitLab data directories:
-- Hunt for suspicious child processes of GitLab services and recent file drops
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (CommandLine =~ 'gitlab-workhorse|puma|gitaly'
OR Exe =~ '/opt/gitlab/')
AND Name =~ 'sh|bash|dash|python|perl|curl|wget|nc$'
-- Recent modifications in GitLab web and upload directories (potential web shells)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['/var/opt/gitlab/gitlab-rails/uploads/**/*', '/opt/gitlab/embedded/service/gitlab-rails/public/**/*'])
WHERE Mtime > now() - 604800
AND FullPath =~ '\\.(php|jsp|aspx|py|sh)$'
ORDER BY Mtime DESC
Verification and Remediation Script
Use the following Bash script to inventory exposure: confirm your GitLab version against the patched release in GitLab's advisory, and pull version/crashinfo state from ASA/FTD devices via SSH:
#!/bin/bash
# Exposure check: GitLab version + Cisco ASA/FTD crash state
set -euo pipefail
# --- GitLab self-managed version check (run on the GitLab host) ---
echo "=== GitLab Version ==="
if command -v gitlab-rake >/dev/null 2>&1; then
sudo gitlab-rake gitlab:env:info 2>/dev/null | head -20
fi
cat /opt/gitlab/version-manifest.txt 2>/dev/null | head -3 || true
echo "Compare against the patched versions in GitLab's October 2026 security release notes."
# --- GitLab: recent anomalous requests in Workhorse/Nginx logs ---
echo "=== Suspicious boundary-value integers in access logs (last 24h) ==="
for LOG in /var/log/gitlab/nginx/gitlab_access.log /var/log/gitlab/gitlab-workhorse/current; do
[ -f "$LOG" ] && grep -E '2147483647|2147483648|4294967295|4294967296|9223372036854775807|0x7fffffff|0xffffffff' "$LOG" | tail -20
done
# --- Cisco ASA/FTD: version and crashinfo pull (run from a jump host) ---
ASA_HOST="${1:-firewall.example.com}"
SSH_USER="${2:-admin}"
echo "=== ASA/FTD version and crash status for $ASA_HOST ==="
ssh -o ConnectTimeout=10 "$SSH_USER@$ASA_HOST" <<'EOF'
show version | include Cisco Adaptive|Cisco Secure Firewall|Serial|up
show crashinfo
show reload history
EOF
echo "=== ACTION: If version is affected per Cisco/GitLab advisories, schedule emergency patching. ==="
Remediation
- GitLab (CVE-2026-97229): Upgrade self-managed GitLab CE/EE instances to the patched version identified in GitLab's security release notes for this CVE. Self-managed instances do not auto-patch — treat this as an emergency change. If immediate patching is impossible, restrict network access to the GitLab UI/API to trusted networks and VPN users, enforce SSO/MFA on all accounts, and place the instance behind a WAF with request-size and parameter anomaly rules.
- Cisco ASA/FTD (CVE-2026-76418): Apply the fixed software release per Cisco's security advisory for this CVE. Use
show versionto confirm your train against the First Fixed release table. Until patched, restrict management and exposed service interfaces to known management subnets, disable any non-essential externally reachable services on the appliance, and ensure syslog forwarding is active so crash events are captured off-box (an attacker who crashes the box also destroys local evidence). - Follow CISA KEV and BOD 26-04 deadlines. FCEB agencies are bound by BOD 26-04 remediation timelines; private organizations should mirror the KEV due date as their internal SLA. Add both CVEs to your vulnerability management platform's KEV-priority queue and verify closure with authenticated scanning, not just ticketing.
- Hunt before you patch. KEV listing means exploitation preceded disclosure. Run the detections above over at least 30 days of retained telemetry. A patched-but-already-compromised GitLab server (your source code, CI/CD secrets, and signing keys) or perimeter firewall is an incident, not a closed ticket.
- Credential and secret rotation. If any GitLab compromise indicators are found, rotate CI/CD variables, deploy tokens, personal access tokens, and any cloud credentials stored in the platform — these are the highest-value theft targets on a DevOps host.
- Validate externally. After patching, have your internal red team or an external penetration testing partner validate that the vulnerable endpoints are no longer reachable/exploitable and that no persistence was left behind.
Vendor references: the CISA KEV Catalog entry and alert (October 29, 2026), GitLab's security release notes for CVE-2026-97229, and Cisco's Security Advisory for CVE-2026-76418.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.