CISA says max severity GitLab flaw now exploited in the wild

It means attackers are already using CVE-2026-97229 against real GitLab servers, not merely testing or discussing it. The flaw can let an unauthenticated attacker run their own code remotely. They do this through a crafted regular expression in a CI/CD configuration. That makes unpatched servers active targets, rather than a theoretical risk.

According to the article, attackers exploit insufficient validation in GitLab’s Regular Expression Compiler. An attacker submits a malicious expression that triggers an integer overflow, potentially gaining control of the targeted server. CISA confirmed the activity and added the vulnerability to its Known Exploited Vulnerabilities Catalog.

GitLab fixed the issue in CE and EE versions 19.4.2, 19.3.5, and 19.2.8. Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances, though the number patched is unknown. Federal agencies were ordered to secure servers by Sunday, while CISA urged private organizations to patch immediately.

A malicious regular expression could exploit an integer overflow in GitLab’s CI/CD Regular Expression Compiler. That component parses, compiles, and evaluates patterns in pipeline configuration files. Because validation was insufficient, an unauthenticated remote attacker could turn the crafted pattern into arbitrary code execution on the GitLab server.

In CVE-2026-97229, an attacker could submit a specially crafted pattern through a CI/CD configuration to a vulnerable GitLab instance. As GitLab processed the pattern, the integer overflow could defeat normal validation and let attacker-controlled instructions execute on the server. The crucial danger is that the attacker did not need an account, making the flaw remotely exploitable.

CISA has confirmed active exploitation and added the vulnerability to its Known Exploited Vulnerabilities Catalog. GitLab fixed CE and EE in versions 19.4.2, 19.3.5, and 19.2.8, and released detections for self-managed customers. Shadowserver tracks nearly 2,800 exposed Community Edition instances, so administrators should patch immediately and investigate possible attacks.

GitLab fixed CVE-2026-97229 in CE and EE versions 19.4.2, 19.3.5, and 19.2.8. This matters because the flaw can let an unauthenticated remote attacker run code on a GitLab server.

The weakness affects GitLab’s CI/CD Regular Expression Compiler, which handles expressions in pipeline configuration files. An attacker could submit a maliciously crafted regular expression. Insufficient validation combined with an integer overflow can turn that input into arbitrary code execution.

CISA confirmed active attacks and added the flaw to its Known Exploited Vulnerabilities Catalog. Federal agencies must secure affected servers by Sunday under BOD 26-04. Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances, although their patch status is unknown. Private-sector teams should also patch immediately, because exploitation is already underway.

The exposed population is nearly 2,800 Internet-facing GitLab Community Edition instances tracked by Shadowserver. That matters because reachable, unpatched servers can give attackers a path into software development environments. The count is a snapshot of observed systems, not proof that every listed server remains vulnerable.

CISA confirmed active exploitation of CVE-2026-97229 and added it to its Known Exploited Vulnerabilities catalog. Weak validation and integer overflow can let a crafted pipeline expression run attacker-controlled code remotely. The flaw affects GitLab Community Edition and Enterprise Edition versions addressed in updates 19.4.2, 19.3.5, and 19.2.8.

GitLab’s reach is substantial. Its DevSecOps platform serves more than 50% of Fortune 100 companies and over 70 million users worldwide. The figures do not show how many instances are patched, so organizations should prioritize updates and monitor for exploitation.

CISA’s Known Exploited Vulnerabilities (KEV) Catalog is its public list of flaws confirmed as being exploited in real attacks. Its purpose is to signal urgent remediation, rather than treating a flaw as a routine update.

For CVE-2026-97229, CISA confirmed active exploitation and added it to KEV. Under Binding Operational Directive 26-04, federal agencies were ordered to secure affected GitLab servers by Sunday. This directive sets a government deadline for urgent action.

The order applies to federal agencies, not private companies. However, CISA encouraged private-sector security teams and other organizations to prioritize patching because attackers could execute code through a malicious regular expression. GitLab had already released fixes in versions 19.4.2, 19.3.5, and 19.2.8, while Shadowserver tracked nearly 2,800 exposed Community Edition instances.

Self-managed GitLab servers are especially valuable because they connect directly to company systems. They sit on organizations’ own networks and may expose development data and controls to the Internet. A single serious weakness can provide a direct path into systems, projects, credentials, and secrets.

CVE-2026-97229 shows the risk clearly. Attackers can send a malicious regular expression through a CI/CD configuration. They can exploit an integer overflow and weak validation to run code without authenticating.

CISA confirmed active exploitation, added the flaw to its Known Exploited Vulnerabilities Catalog, and ordered federal agencies to patch by Sunday. Shadowserver tracks nearly 2,800 exposed GitLab CE instances, while GitLab serves over 70 million users. Administrators should patch to 19.4.2, 19.3.5, or 19.2.8 and use GitLab’s detections.

An integer overflow happens when a calculation produces a number too large for its assigned storage space. The value can wrap around or become incorrect, causing software to misjudge sizes, limits, or memory locations.

In GitLab’s CVE-2026-97229, a malicious regular expression passed through the CI/CD Regular Expression Compiler. Poor validation allowed the overflow to influence processing, potentially letting an unauthenticated remote attacker execute code on the server. Input that looked like configuration became a path to control.

CISA confirmed active exploitation and added the flaw to its Known Exploited Vulnerabilities Catalog. GitLab fixed it in versions 19.4.2, 19.3.5, and 19.2.8, while Shadowserver tracked nearly 2,800 exposed Community Edition instances. Administrators should patch promptly because automated parsers must treat every input as potentially hostile.