CISA confirms active exploitation of GitLab CVE-2026-97229
Original title: CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229
Unauthenticated attackers can run code via a crafted CI/CD regex; federal remediation is due November 1.
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29 after confirming active exploitation against GitLab Community Edition and Enterprise Edition. The CVSS 10.0 flaw is an integer overflow from insufficient regular-expression validation, letting an unauthenticated attacker send a crafted expression in CI/CD configuration and execute arbitrary code. Fixed releases are 19.2.8, 19.3.5 and 19.4.2. Public sources do not name attackers, victims or campaign scale, and ransomware use is listed as unknown.
Unconfirmed: Attackers, victim organizations, campaign scale and ransomware involvement are not identified.
- Affected ranges are 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2.
- The CVE record was published on October 13 and credits researcher joaxcar.
- BOD 26-04 requires forensic triage as well as remediation by November 1.
- The CVSS vector is network, low complexity, no privileges and no user interaction.
- CISA says to apply mitigations, assess internet exposure, or stop using the product.
Impact: Unauthenticated remote code execution on the GitLab server
| Product | Affected | Fixed in |
|---|---|---|
| GitLab Community Edition and Enterprise Edition | 19.2 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 | 19.2.8, 19.3.5 and 19.4.2 |
- 1.Upgrade affected GitLab branches to 19.2.8, 19.3.5 or 19.4.2.
- 2.Perform required forensic triage and assess each server’s internet exposure.
- CVEs
- CVE-2026-97229
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 18% | KEVPoC ×5 | KEV |
From the original article
2 min read at gbhackers.com
The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that CVE-2026-97229, a critical vulnerability affecting both GitLab Community Edition and Enterprise Edition, is actively being exploited. On October 29, 2026, CISA added this flaw to its Known Exploited Vulnerabilities catalog, increasing the urgency for organizations running affected servers to take action.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.