CISA Flags Cisco and GitLab Flaws as Actively Exploited, Adds Them to KEV List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Thursday that it has added two critical software flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing concrete evidence that threat actors are already leveraging the issues in the wild.

The first entry concerns a remote‑code‑execution (RCE) vulnerability in GitLab, identified as CVE‑2026‑97229. The flaw allows an attacker who can submit specially crafted data to execute arbitrary commands on the underlying server, potentially compromising the entire code repository platform. While the vulnerability primarily affects self‑hosted GitLab installations, the open‑source nature of the software means that any organization running its own instance could be exposed.

The second vulnerability targets Cisco's firewall line, where a denial‑of‑service (DoS) weakness can be triggered by malformed network traffic. Exploitation can cause the firewall to become unresponsive, effectively disrupting the flow of legitimate traffic and exposing protected networks to further attack. Given the widespread deployment of Cisco firewalls in enterprise and government environments, the impact could be significant if left unaddressed.

CISA’s KEV program is designed to highlight vulnerabilities that have moved beyond theoretical risk and are being actively weaponized. Inclusion in the KEV list signals to federal agencies and the broader public‑sector community that immediate remediation is required. The agency typically advises organizations to apply available patches, implement mitigations, or, where patches are not yet released, to employ compensating controls such as network segmentation and strict input validation.

The additions come amid a broader trend of accelerated exploitation of software flaws, as attackers increasingly target supply‑chain and infrastructure components. Security teams are urged to monitor vendor advisories for patch releases and to prioritize the GitLab and Cisco updates in their vulnerability‑management workflows. Analysts expect both vendors to issue patches in the coming weeks, and CISA will likely update its guidance as more information becomes available.