Over 1,000 GitLab servers vulnerable to ongoing RCE attacks

CVE-2026-97229 is a maximum-severity vulnerability in GitLab’s CI/CD Regular Expression Compiler. The compiler parses and evaluates regular expressions used in pipeline configuration files. The flaw matters because insufficient validation can turn an input-processing weakness into remote code execution, allowing an attacker to run commands on a GitLab server without authentication.

An attacker can submit a specially crafted regular expression through a CI/CD configuration. The article identifies the underlying weakness as an integer overflow. Under certain conditions, that overflow can undermine how the compiler handles the expression and allow arbitrary code execution on the targeted GitLab instance.

GitLab released fixes in versions 19.4.2, 19.3.5, and 19.2.8. CISA later confirmed active exploitation, while Shadowserver reported more than 1,000 exposed, unpatched servers. Because exploitation is already occurring, self-managed installations need immediate upgrading rather than waiting for routine maintenance.

Shadowserver reported that it was tracking over 1,000 GitLab instances vulnerable to CVE-2026-97229. These systems are Internet-exposed and remain unpatched even though GitLab released fixes three weeks earlier. Their exposure is especially serious because CISA has confirmed that attackers are exploiting this flaw in the wild.

The related Regular Expression Compiler vulnerability, CVE-2026-110264, affects a much larger observed population. Shadowserver said it tracked over 11,300 vulnerable instances out of around 39,000 GitLab instances it sees daily. The article identifies this later flaw as another maximum-severity bug that can allow arbitrary code execution on targeted instances.

The figures describe Shadowserver’s monitoring, not every GitLab server worldwide. Still, they show that patching remains incomplete across exposed installations. The contrast also highlights a broader risk: fixing one compiler flaw does not remove exposure to another unpatched vulnerability in the same component.

When CISA says attackers are exploiting CVE-2026-97229 in the wild, it means the vulnerability is being used in actual attacks, rather than merely demonstrated or discussed as a theoretical risk. Shadowserver also reported more than 1,000 exposed, unpatched GitLab servers amid ongoing attacks.

The flaw is especially dangerous because it can be exploited by an unauthenticated user. An attacker does not first need a valid GitLab account or stolen password. By sending a specially crafted regular expression in a CI/CD configuration, the attacker may reach the vulnerable compiler and execute arbitrary code on the server.

That combination removes two important barriers: authentication and safe code execution. A compromised server could then become a launch point for accessing repositories, secrets, or software-delivery systems, depending on its permissions and connections. The active exploitation makes immediate patching more urgent than ordinary vulnerability management.

The required action applies to self-managed GitLab installations running Community Edition or Enterprise Edition. GitLab strongly recommends upgrading these systems immediately because CVE-2026-97229 is being exploited and more than 1,000 exposed instances remain vulnerable.

GitLab’s patched releases are CE and EE versions 19.4.2, 19.3.5, and 19.2.8. These versions include security and bug fixes. Administrators of self-managed systems must apply one of the listed upgrades, rather than assuming that an exposed server is safe because it is behind normal account controls.

GitLab.com users do not need to take action because GitLab says the hosted service is already running a patched version. GitLab Dedicated customers likewise do not need to act, according to the company. The distinction is who operates the installation: GitLab handles patching for those hosted services, while self-managed customers handle their own upgrades.

CISA’s Known Exploited Vulnerabilities, or KEV, Catalog is a list of security flaws that are being actively abused by attackers. CVE-2026-97229 was added after CISA confirmed that exploitation had begun in the wild. The listing signals that the issue is not only a possible future threat.

For federal agencies, the catalog entry carries an operational deadline. CISA ordered agencies to secure their affected GitLab servers by Sunday. That requirement turns the vulnerability from a routine patching item into an urgent government security task, especially because the flaw permits unauthenticated remote code execution.

The catalog entry also helps focus attention on systems that attackers are already targeting. It does not patch servers itself. Agencies and other operators still need to apply GitLab’s fixed releases, check whether exposed installations remain vulnerable, and address related risks such as CVE-2026-110264, which Shadowserver also found on thousands of instances.

A GitLab server often sits close to source repositories, CI/CD configurations, build jobs, and deployment credentials. If an attacker gains control through remote code execution, the server may provide access to information and connected systems that depend on its permissions. The article specifically links GitLab flaws with stealing credentials and other secrets.

For example, arbitrary code running on the server could search accessible repositories and configuration files, inspect pipeline variables, or use credentials available to build and deployment jobs. It could also alter pipeline behavior or software before delivery. The exact impact would depend on the compromised instance’s permissions, stored secrets, and network connections.

This makes the vulnerability more than a server-level problem. A compromised GitLab instance could affect the confidentiality of source code and the integrity of software-delivery processes. The article reports that CVE-2026-85706 can steal credentials and secrets, while CVE-2026-97229 and CVE-2026-110264 enable arbitrary code execution.

CI/CD pipelines are automated workflows defined by configuration files. They help organizations move code through activities such as testing, building, and delivery. In GitLab, the CI/CD Regular Expression Compiler parses and evaluates regular expressions used in those configurations. That makes the compiler part of the machinery interpreting pipeline input.

The article’s example shows the security risk. A specially crafted regular expression can reach the compiler, where an integer overflow and insufficient validation may allow arbitrary code execution. Instead of merely processing a pattern, the vulnerable component can become a route to running attacker-controlled code on the GitLab server.

Because GitLab is a DevSecOps platform used by more than 50% of Fortune 100 companies, weaknesses in pipeline processing can have broad organizational consequences. A compromised platform may expose source code, credentials, or secrets and undermine software delivery. The article’s exploitation reports show why pipeline components require prompt patching.