CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that CVE-2026-97229, a critical vulnerability affecting both GitLab Community Edition and Enterprise Edition, is actively being exploited.

On October 29, 2026, CISA added this flaw to its Known Exploited Vulnerabilities catalog, increasing the urgency for organizations running affected servers to take action.

This vulnerability allows unauthenticated attackers to execute arbitrary code on a GitLab server by using a specially crafted regular expression within a CI/CD configuration. GitLab attributes the issue to insufficient regular expression validation and classifies it as an integer overflow or wraparound weakness, listed under CWE-190.

GitLab Vulnerability CVE-2026-97229

According to the official CVE record, the vulnerability carries a CVSS v3.1 score of 10.0. Its vector describes network-based exploitation with low attack complexity, no required privileges, and no user interaction. Successful exploitation can severely impact confidentiality, integrity, and availability.

Integer overflow occurs when an arithmetic result exceeds the range supported by its underlying representation. Unexpected values can disrupt security checks or memory-related operations, although the published GitLab description does not identify the precise internal exploitation sequence.

The issue previously prompted critical GitLab security updates addressing unauthenticated remote code execution. CISA’s confirmation now establishes that exploitation is occurring beyond a theoretical attack scenario.

Affected releases include:

• GitLab 19.2 versions before 19.2.8.
• GitLab 19.3 versions before 19.3.5.
• GitLab 19.4 versions before 19.4.2.

GitLab credits security researcher joaxcar with reporting the vulnerability through its HackerOne bug bounty program. The CVE record was published on October 13, 2026.

The supplied catalog entry specifies a November 1, 2026, remediation deadline and marks forensic triage as required under BOD 26-04. It lists ransomware involvement as unknown; that designation does not establish whether ransomware operators have exploited the flaw.

Organizations must apply vendor-directed mitigations while following the applicable patching and forensic triage requirements. The entry also directs stakeholders to evaluate each asset’s internet exposure and follow relevant cloud-service guidance, or discontinue product use when mitigations are unavailable.

This incident follows earlier GitLab patches addressing CI/CD tampering and data exposure, underscoring the importance of protecting development infrastructure without conflating separate vulnerabilities.

For affected deployments, the fixed releases are 19.2.8, 19.3.5, and 19.4.2. Administrators should verify their installed branch against these thresholds and prioritize remediation because CISA has confirmed exploitation. The public sources reviewed do not identify attackers, victim organizations, or campaign scale.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.