CISA flags actively exploited GitLab and Ivanti flaws

· Cybersecurity · United States

The U.S. Cybersecurity and Infrastructure Security Agency added actively exploited vulnerabilities in GitLab and Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch. The GitLab flaw, tracked as CVE-2026-97229 with a maximum CVSS score of 10.0, is an integer overflow allowing unauthenticated attackers to run arbitrary code on servers; SecurityWeek reported it being exploited against Alpine Linux. Ivanti Connect Secure has two flaws added to the catalog, including CVE-2026-111357 with a CVSS score of 8.8, which attackers chain to gain unauthenticated root access. CISA also added a Cisco firewall denial-of-service flaw. The listings signal that exploitation is underway in the wild, not merely theoretical, and put deadlines on federal remediation while private defenders weigh emergency patching of internet-facing systems.

Why it matters：KEV listings are the clearest public signal that a vulnerability is being used in real attacks, pushing both government and private defenders into emergency patching of internet-facing infrastructure.

Key points

  • GitLab's CVE-2026-97229 carries a maximum CVSS score of 10.0 and allows unauthenticated remote code execution.
  • Ivanti flaws are chained to gain unauthenticated root access on Connect Secure appliances.
  • CISA's catalog carries binding remediation deadlines for U.S. federal agencies.

Sources (original reporting)

More stories from this day