# Two due dates were today

2026-11-01

Two KEV rows CISA added on 29 October were due today. GitLab CVE-2026-97229 is an unauthenticated code-execution bug in CI regex handling and needs a look, not only a patch. Cisco ASA and FTD CVE-2026-76418 is a remote crash. Ivanti Connect Secure’s privilege row is due tomorrow.

Canonical: https://www.fabiocti.com/notes/two-due-dates-were-today/
Author: Fabio Correia

Two clocks ran out today. Neither is a Japanese member file.

CISA put GitLab Community and Enterprise CVE-2026-97229 on the exploited list on 29 October and set today as the federal due date. Integer overflow in how a CI configuration’s regular expression is checked. Unauthenticated. Code execution on the GitLab server. The directive also wants a look at whether the box was used before the patch, not only that the patch is on.

The other due date today is Cisco Secure Firewall ASA and FTD CVE-2026-76418: an unchecked return that can take the appliance down from the network, no login. A crash is not a theft of sessions. It is still a due date.

Ivanti Connect Secure has two new rows from Friday. CVE-2026-111357, missing authentication for a critical function, is due tomorrow and also wants the look-back. CVE-2026-118527, predictable identifiers, is due 13 November. CISA says they chain with an older Connect Secure row. That is a VPN sentence, not a member count.

## What two due dates will be asked to cover

It will be briefed as every GitLab on earth already owned, and as every Cisco firewall emptied. One is a CI regex that needs a forensic pass. One is a crash. Ivanti is tomorrow. A still-green pipeline is evidence about today’s build. It is not a finding that the regex never ran.

If you run GitLab on the public internet, the patch and the look-back are the incident. If you run ASA or FTD, the crash is the incident. A “support” mail that already knows the CVE and asks for a config dump is not CISA.

Two due dates were today. The look-back is the part people skip.