CISA expands known exploited catalog with software vulnerabilities

The Cybersecurity and Infrastructure Security Agency added new actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on October 29, 2026. CISA Alerts reported that the additions include CVE-2026-97229, an integer overflow or wraparound issue in GitLab Community Edition and Enterprise Edition. CISA Alerts also noted the addition of CVE-2026-76418, affecting Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense. [1]

Multiple security news outlets reported additional flaws added to the agency list. GBHackers News and CyberSecurityNews both reported that CISA added an actively exploited VMware ESXi logging vulnerability. SecNews.gr reported that Chinese hackers previously exploited a VMware ESX zero day flaw before its inclusion in the catalog. Security Affairs confirmed that CISA added Linux Kernel and Broadcom VMware ESX flaws to the list. [2][3][4][6]

Earlier catalog updates also mandated federal action. BigGo Finance reported that CISA added two PHP vulnerabilities to the list and ordered federal agencies to complete patches by October 29. SQ Magazine reported on October 28 that CISA added the exploited Brotli Node2Shell flaw to the catalog. [5][7]

According to CISA Alerts, these types of vulnerabilities serve as frequent attack vectors for malicious actors and pose significant risks to federal infrastructure. CISA Alerts stated that Binding Operational Directive 26-04 establishes vulnerability management requirements that require Federal Civilian Executive Branch agencies to prioritize rapid remediation. [1]