The GitLab patch came out on October 12, rated 10.0. On October 29, 17 days later, CISA said the flaw is being used.
Fact
The facts: on October 29, 2026 CISA added two entries to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-97229 is in GitLab Community Edition and Enterprise Edition: an integer overflow in the CI/CD regular expression compiler. GitLab rates it Critical, CVSS 10.0, and fixed it on October 12 in versions 19.4.2, 19.3.5 and 19.2.8. CISA describes the flaw as one that could allow an unauthenticated user to execute arbitrary code on the GitLab server. CVE-2026-76418 is in Cisco Secure Firewall ASA and Secure FTD, in the remote access SSL VPN service: an unauthenticated remote attacker can reload the device (denial of service), CVSS 8.6 per CVE.org. Cisco's advisory is from October 28 and says that in October 2026 the Cisco PSIRT became aware of active exploitation. Affected are devices with secondary authentication configured on a tunnel group. There is no workaround; as a mitigation Cisco describes disabling secondary authentication, but it recommends upgrading. In CISA's catalog both entries are dated October 29 with a due date of November 1, and ransomware use is marked as unknown. For the GitLab entry the catalog marks forensic triage as required under BOD 26-04; for Cisco it does not.
GitLab's own notice does not say the flaw is being exploited. CISA says that. Cisco is different: it says so itself, in its own advisory.
With Cisco the hit is denial of service, not code execution: the attacker can reload the device without authenticating. For a VPN gateway that is bad enough, because while it restarts, nobody gets in through it.
GitLab says fixed. CISA says exploited.
The deadline falls on a Sunday.
That is November 1, three days after the listing, and it applies to federal civilian executive branch agencies in the US (FCEB). For you it is a benchmark, not a law.
A listing comes when CISA has evidence of attacks. When exactly the attacks began, we do not know: the 17 days run between the patch and the confirmation, not between the patch and the first attacker. Who is attacking and how many GitLab servers were hit, we do not know either.
GitLab on your own server: the 19.2, 19.3 and 19.4 lines before 19.2.8, 19.3.5 and 19.4.2 are affected. Below those, you update today. Cisco ASA or FTD with remote access SSL VPN and secondary authentication: the fixed versions are in Cisco's advisory, and the mitigation does not replace the upgrade.
For self-managed servers GitLab has also released six threat detections to look for attempts to use the flaw. Run them after you update.
Sources
CISA KEV (CVE-2026-97229, CVE-2026-76418)CISA KEV catalog entry (CVE-2026-97229)GitLab patch release 19.4.2 (CVE-2026-97229)Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (CVE-2026-76418)The visual is generated code-art, no third-party images.