More than 1,000 internet-exposed GitLab servers remain unpatched, Shadowserver reported, three weeks after patches were released for a maximum-severity remote code execution flaw that CISA said attackers had begun exploiting in the wild.
Tracked as CVE-2026-97229, the maximum-severity flaw stems from an integer overflow weakness in the CI/CD Regular Expression Compiler. “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,” the company explained on October 12 when it released security patches for GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. The company urged all self-managed installations to upgrade immediately and said GitLab.com was already running the patched version, while GitLab Dedicated customers did not need to take action.
On Friday, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that attackers had begun exploiting the flaw. CISA ordered federal agencies to secure their servers by Sunday.
Shadowserver, a threat watchdog, said on Sunday: "We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitLab instances we see daily)." CVE-2026-110264 is another maximum-severity Regular Expression Compiler bug that GitLab fixed last month, which also allows arbitrary code execution.
GitLab says its DevSecOps platform has over 70 million registered users and is used by more than 50% of Fortune 100 companies worldwide. Since November 2021, CISA has added six GitLab vulnerabilities to its KEV catalog, one of which has been used in ransomware attacks. The series of security issues this year includes a high-severity two-factor authentication bypass in January and a maximum-severity credential-stealing vulnerability in the repository commits API in September. CISA flagged the September vulnerability as actively abused in the wild after cybersecurity firm watchTowr reported that attackers had begun scanning for vulnerable GitLab servers.
Analysis
Why This Matters
- The active exploitation of unpatched GitLab servers puts sensitive code, credentials, and internal systems at risk for thousands of organizations.
- GitLab’s dominance in the enterprise (over 50% of Fortune 100) means a successful attack could have cascading effects across many companies.
- The repeated discovery and exploitation of critical flaws in GitLab’s regular expression compiler suggests a systemic security concern that may require deeper remediation.
Background
GitLab is a widely used DevSecOps platform with over 70 million registered users. In 2026, GitLab has patched several critical vulnerabilities, including two other maximum-severity RCE flaws (CVE-2026-85706 in September and CVE-2026-110264 in October) that have been actively exploited. CISA has added six GitLab vulnerabilities to its KEV catalog since November 2021, reflecting the platform’s attractiveness as a target.
What to Watch
- How quickly the remaining unpatched instances are secured, and whether attackers launch a broader campaign.
- Whether GitLab introduces additional safeguards or changes to its regular expression parsing in future updates.
- Potential regulatory or internal pressure on organizations to prioritize patching GitLab servers given the recurring critical vulnerabilities.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedMore than 1,000 internet-exposed GitLab servers remain unpatched against an actively exploited RCE vulnerability.BleepingComputer: “Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks.”
- SupportedCISA added CVE-2026-97229 to its Known Exploited Vulnerabilities Catalog.BleepingComputer: “On Friday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers have begun exploiting the flaw in the wild and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog”
- SupportedCISA ordered federal agencies to secure their servers by Sunday.BleepingComputer: “ordering federal agencies to secure their servers by Sunday.”
- SupportedShadowserver reported that more than 1,000 internet-exposed GitLab servers remained unpatched.BleepingComputer: “Although GitLab released patches three weeks ago, threat watchdog Shadowserver revealed over the weekend that it tracks more than 1,000 unpatched GitLab servers exposed to ongoing attacks.”
- SupportedThe servers remained unpatched three weeks after patches were released for the flaw.BleepingComputer: “Although GitLab released patches three weeks ago”
- SupportedCISA said attackers had begun exploiting the flaw in the wild.BleepingComputer: “CISA confirmed that attackers have begun exploiting the flaw in the wild”
- SupportedThe flaw stems from an integer overflow weakness in the CI/CD Regular Expression Compiler.BleepingComputer: “this vulnerability stems from an integer overflow weakness and was discovered in the CI/CD Regular Expression Compiler”
- SupportedThe quoted explanation from GitLab accurately reproduces its statement about the potential unauthenticated code execution issue.BleepingComputer: “"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,"”
- SupportedGitLab released patches on October 12 for CE and EE versions 19.4.2, 19.3.5 and 19.2.8.BleepingComputer: “the company explained on October 12 when it released security patches to address the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8.”
- SupportedThe Shadowserver quotation accurately reports over 1,000 instances vulnerable to CVE-2026-97229 and over 11,300 vulnerable to CVE-2026-110264, out of around 39,000 GitLab instances seen daily.BleepingComputer: “"We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitLab instances we see daily),"”
- SupportedCVE-2026-110264 is another maximum-severity Regular Expression Compiler bug that GitLab fixed last month and that allows arbitrary code execution.BleepingComputer: “Last month, it addressed another maximum-severity Regular Expression Compiler bug (CVE-2026-110264) that lets threat actors run arbitrary code on targeted instances.”
- SupportedSince November 2021, CISA has added six GitLab vulnerabilities to its catalog, and one has also been used in ransomware attacks.BleepingComputer: “Since November 2021, CISA has added six GitLab flaws to its catalog of actively exploited vulnerabilities, one of which has also been used in ransomware attacks.”
