Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
CISA added CVE-2026-97229 to KEV catalog; over 1,000 unpatched GitLab instances exposed to exploitation.
Over 1,000 Internet-exposed GitLab servers remain unpatched against CVE-2026-97229, an integer overflow flaw in the CI/CD Regular Expression Compiler. GitLab released patches for versions 19.4.2, 19.3.5, and 19.2.8 on October 12. CISA confirmed active exploitation in the wild and ordered agencies to patch by Sunday.
- CVE-2026-97229 actively exploited per CISA KEV
- Shadowserver tracks over 1,000 vulnerable exposed servers
- GitLab.com and Dedicated customers already patched
- Self-managed instances must upgrade immediately
Impact: unauthenticated remote code execution via crafted regular expression
- 1.upgrade to versions 19.4.2, 19.3.5 or 19.2.8
- 2.check for exposed instances
- CVEs
- CVE-2026-97229
- Vendors
- GitLab
- Organizations
- CISAShadowserver
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 27% | KEVPoC ×6 | KEV |
From the original article
2 min read at bleepingcomputer.com
Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.