Act
active
CISA KEV: GitLab RCE (CVSS 10.0) and Cisco Firewall DoS Actively Exploited
- Engineer — Act: Patch GitLab CE/EE immediately to the fixed version addressing CVE-2026-97229 (CVSS 10.0, KEV-listed, public PoC on GitHub); also apply the Cisco firewall DoS fix. KEV listing with public PoC confirms active exploitation pressure.
- SOC/IR — Act: Hunt for exploitation attempts against GitLab instances since KEV listing date — look for anomalous API calls or unauthenticated RCE indicators in web/application logs; write or enable detections for CVE-2026-97229 exploitation patterns given the public PoC and confirmed active exploitation.
- Leader — Plan: Confirm with engineering that GitLab and Cisco firewall patching is on an accelerated track given KEV status; no board-level event unless exploitation is confirmed in your environment, but verify remediation timelines are within CISA’s required window.
- Signals: CVE-2026-97229 — CISA KEV: listed, EPSS 0.27, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.