GitLab: Maximum-Severity RCE Now Exploited in the Wild

If you run a self-managed GitLab server, stop reading and go patch. CISA has confirmed that attackers are actively exploiting CVE-2026-97229, a maximum-severity vulnerability in GitLab's CI/CD Regular Expression Compiler, the component that parses and evaluates regular expressions in pipeline configuration files.

The flaw is an integer overflow weakness: a specially crafted regular expression in a CI/CD configuration can let an unauthenticated attacker run arbitrary code on the GitLab server itself. Discovered by a researcher going by 'joaxcar', it was patched earlier this month - and exploitation has now begun.

Patch status, and a Sunday deadline

GitLab fixed the issue in Community Edition and Enterprise Edition 19.4.2, 19.3.5, and 19.2.8, and has released threat detections for self-managed customers after spotting exploitation attempts. CISA added the CVE to its Known Exploited Vulnerabilities catalog on Thursday and gave US federal agencies until Sunday - today - to secure their servers under Binding Operational Directive 26-04. Private-sector teams are urged to treat it the same way. Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances, with no count of how many are patched.

A rough year for GitLab

This is not an isolated wound. GitLab patched a high-severity two-factor authentication bypass in January, another maximum-severity Regular Expression Compiler RCE (CVE-2026-110264) earlier this month, and a maximum-severity repository commits API flaw (CVE-2026-85706) that could leak credentials - which CISA also flagged as exploited within days. Six GitLab vulnerabilities have landed in CISA's exploited catalog since 2021. With over 50% of Fortune 100 companies on the platform, every one of these is a supply-chain problem, not just a server problem.