AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) payshanba kuni Cisco va GitLab dasturiy ta'minotiga ta'sir qiluvchi ikkita xavfsizlik zaifligini faol ekspluatatsiya qilinishi dalillari asosida o'zining Ma'lum ekspluatatsiya qilingan zaifliklar (KEV) ro'yxatiga qo'shdi.
Zaifliklar quyidagilar:
- CVE-2026-97229 (CVSS balli: 10.0) — GitLab Community Edition va Enterprise Edition'dagi butun son to'lib ketishi yoki o'ralishi zaifligi, bu autentifikatsiyadan o'tmagan foydalanuvchiga CI/CD konfiguratsiyasidagi maxsus tayyorlangan muntazam ifoda orqali yetarli darajada muntazam ifoda tekshiruvi yo'qligi sababli GitLab serverida ixtiyoriy kodni bajarish imkonini berishi mumkin.
- CVE-2026-76418 (CVSS balli: 8.6) — Cisco Secure Firewall Adaptive Security Appliance (ASA) Software va Secure Firewall Threat Defense (FTD) Software'dagi tekshirilmagan qaytish qiymatidan NULL ko'rsatkichiga dereferensiya zaifligi, bu autentifikatsiyadan o'tmagan, masofaviy hujumchiga qurilmani kutilmaganda qayta yuklashga majbur qilish, natijada xizmatdan foydalanishni rad etish (DoS) holatini keltirib chiqarish imkonini berishi mumkin.
Bu rivojlanish Cisco shu oy boshida ushbu zaiflikning faol ekspluatatsiya qilinishi haqida xabardor bo'lganini aytganidan keyin sodir bo'ldi. U hujumchilarni, nishonga olingan tashkilotlar sonini yoki hujumchilar dastlabki kirishdan keyin qilgan harakatlarini ommaviy ravishda aniqlamagan.
CVE-2026-97229 ga kelsak, uning qo'shilishi Alpine Linux tomonidan e'lon qilingan xavfsizlik hodisasi bilan bog'liq, unda noma'lum tahdid aktori 2026-yil 20 va 21-oktabr kunlari o'zining nusxasiga nishon qilib, zaiflikni muvaffaqiyatsiz ekspluatatsiya qilishga uringan.
Xususan, hujumchi tuzatilmagan GitLab nusxasini maxsus tayyorlangan CI konfiguratsiyalarini yuborish orqali tekshirgan, natijada GitLab ishchi jarayonlari sakkiz marta ishdan chiqqan. Ushbu ishdan chiqishlarning to'rttasida ekspluatatsiya keyingi bosqichda muvaffaqiyatsizlikka uchragan.
Tahdid aktori shuningdek Alpine Linux'ning GitLab konteyner tasvirini yuklab olgan. Hujumchining 25 va 26-oktabr kunlari qayta kirishga urinishlari bloklangan.
"Hujum muvaffaqiyatga yaqinlashdi," deb aytishdi xavfsizlikka yo'naltirilgan Linux distributsiyasi saqlovchilari. "Biz uning muvaffaqiyatga erishganiga dalil topmadik, lekin buni inkor eta olmaymiz, shuning uchun nusxani buzilgan deb hisobladik va uni noldan qayta qurdik. Bizning tekshiruvlarimiz aports ombori, paketlar va 21-oktabr relizlari buzilmaganini ko'rsatmoqda."
Faol ekspluatatsiya qilinishini inobatga olib, Federal Fuqarolik Ijroiya Tarmog'i (FCEB) agentliklariga tuzatishlarni 2026-yil 1-noyabrgacha qo'llash tavsiya etiladi.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.
The vulnerabilities are listed below -
- CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation.
- CVE-2026-76418 (CVSS score: 8.6) - An unchecked return value to NULL pointer dereference vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.
The development comes after Cisco said it became aware of active exploitation of this vulnerability earlier this month. It has not publicly identified the attackers, the number of targeted organizations, or the actions taken by attackers after gaining initial access.
As for CVE-2026-97229, its addition relates to a security incident disclosed by Alpine Linux in which an unknown threat actor unsuccessfully attempted to exploit the flaw targeting its instance on October 20 and 21, 2026.
Specifically, the attacker probed an unpatched GitLab instance by sending crafted CI configurations, causing the GitLab worker processes to crash eight times. In four of those crashes, the exploit failed at the next step.
The threat actor also downloaded Alpine Linux's GitLab container image. Subsequent attempts by the attacker to get back in on October 25 and 26 were blocked.
"The attack came close to working," the maintainers of the security-focused Linux distribution said. "We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with."
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the fixes by November 1, 2026.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.