CISA Expands KEV Catalog: Critical Exploits Target GitLab and Cisco Infrastructure

Executive Summary

Encrygma analysts assess that the recent addition of CVE-2026-97229 and CVE-2026-76418 to the CISA Known Exploited Vulnerabilities (KEV) catalog represents a significant escalation in the threat landscape. These vulnerabilities, affecting GitLab and Cisco Secure Firewall respectively, are currently being weaponized by sophisticated actors to gain unauthorized access to critical enterprise infrastructure.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, the exploitation of these vulnerabilities aligns with a broader trend of targeting edge-facing network appliances. Using the Encrygma Threat Severity Index (ETSI), we assign these vulnerabilities a score of 9.4/10, reflecting their potential for remote code execution and the high probability of continued in-the-wild exploitation by state-aligned actors.

Technical Details

Encrygma threat data shows that CVE-2026-97229 involves an integer overflow vulnerability in GitLab Community and Enterprise Editions, while CVE-2026-76418 in Cisco Secure Firewall ASA and FTD software stems from an unchecked return value leading to a NULL pointer dereference. These flaws allow attackers to bypass security controls or crash critical services, facilitating further lateral movement within compromised networks.

Attribution Assessment

Based on the Encrygma Attribution Confidence Matrix, we classify the current exploitation campaigns as 'High Confidence' nation-state activity. Encrygma analysts observe tactical overlaps with previous campaigns attributed to groups known for weaponizing zero-day vulnerabilities in edge devices to maintain persistent, covert access while bypassing standard audit logging mechanisms.

Implications

Encrygma threat intelligence indicates that organizations failing to patch these vulnerabilities face an elevated risk of data exfiltration and credential theft. The ability of these exploits to bypass traditional perimeter defenses necessitates a shift toward zero-trust architectures and enhanced forensic monitoring, as updates may inadvertently obscure evidence of prior compromise.

Recommendations

Encrygma recommends immediate prioritization of these patches across all internet-facing assets. Organizations should utilize the Encrygma AI Threat Taxonomy to identify potential AI-driven reconnaissance patterns targeting their infrastructure. Furthermore, forensic teams should perform integrity checks prior to patching to ensure that no persistent backdoors have been established by threat actors during the window of vulnerability.