CISA Adds GitLab CVE-2026-97229 and Cisco CVE-2026-76418 to KEV After Alpine Probe and Firewall Exploits

The GitLab flaw (CVSS 10.0) stems from insufficient regex validation in CI/CD pipelines, allowing remote code execution without authentication. Alpine Linux disclosed eight worker crashes on October 20-21 from targeted probes against an unpatched instance, followed by container image downloads; four attempts reached the final stage before failing. CISA set a November 1, 2026 deadline for FCEB agencies. Cisco CVE-2026-76418 (CVSS 8.6) permits remote reloads on Secure Firewall appliances, with exploitation confirmed earlier in October but no actor attribution released.

Procurement records and prior KEV entries show repeated patterns: GitLab instances in build pipelines remain high-value targets for supply-chain persistence, while firewall DoS flaws disrupt perimeter telemetry during coordinated campaigns. The Alpine incident reveals incomplete exploit chains yet full rebuilds, indicating defenders now treat near-misses as full compromises absent forensic proof. Cross-referencing CISA additions with Alpine logs and Cisco bulletins indicates exploitation predates public disclosure by days to weeks.

Federal patching mandates will accelerate exposure reduction, but commercial operators outside FCEB face no equivalent timeline. Expect secondary incidents once public exploit code circulates, particularly against self-hosted GitLab deployments lacking regex hardening.