Attackers exploit max-severity GitLab flaw CVE-2026-97229
Original title: CISA says max severity GitLab flaw now exploited in the wild
The integer overflow allows unauthenticated code execution through a crafted CI/CD regular expression; fixes are 19.4.2, 19.3.5, and 19.2.8.
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting the maximum-severity GitLab bug. The flaw, found by researcher joaxcar in the CI/CD Regular Expression Compiler, is an integer overflow that can let an unauthenticated user run arbitrary code via a crafted regular expression. GitLab patched Community Edition and Enterprise Edition in 19.4.2, 19.3.5, and 19.2.8 and released detections after seeing exploitation attempts. Federal agencies must secure servers by Sunday under BOD 26-04.
Unconfirmed: Shadowserver does not say how many of the exposed instances are still unpatched.
- Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances.
- GitLab says more than 70 million registered users and over half of the Fortune 100 use the platform.
- CISA urged private-sector teams to prioritize patching as well.
- GitLab previously fixed related maximum-severity issues CVE-2026-110264 and CVE-2026-85706.
Impact: Unauthenticated remote code execution on the GitLab server
| Product | Affected | Fixed in |
|---|---|---|
| GitLab Community Edition and Enterprise Edition | — | 19.4.2, 19.3.5, and 19.2.8 |
- 1.Upgrade GitLab CE and EE to 19.4.2, 19.3.5, or 19.2.8.
- 2.Federal agencies must secure affected servers by Sunday under BOD 26-04.
- CVEs
- CVE-2026-97229
- Vendors
- GitLab
- Organizations
- CISAShadowserver
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 18% | KEVPoC ×5 | KEV |
From the original article
2 min read at bleepingcomputer.com
Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA). [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.