Affected Systems
GitLab Community Edition (CE) and Enterprise Edition (EE) versions 7.0 through 19.5.0. Specifically: 7.0–18.11.12, 19.0–19.0.9, 19.1–19.1.8, 19.2–19.2.8, 19.3–19.3.5, 19.4–19.4.2, and 19.5.0. Critical vulnerability CVE-2026-110264 is an integer overflow in the regular expression compiler enabling unauthenticated remote code execution.
Exploitation Status
Exploitation status unknown. GitLab has published two detection rules for identifying exploitation attempts (onigmo_native_worker_crash and org_mode_render_error_burst), suggesting concern about active or imminent exploitation. No public PoC confirmed in advisory.
Business Impact
Maximum severity (CVSS 10.0) unauthenticated RCE allows complete server compromise without credentials. Internet-facing GitLab instances are at immediate risk of full takeover, data exfiltration, supply chain attacks via repository manipulation, and lateral movement. Organizations using GitLab for CI/CD pipelines face risk of build environment compromise and code injection into production deployments.
Urgency
🔴 Immediate
Recommended Actions
- Immediately patch all GitLab CE/EE instances to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 depending on your version branch, prioritizing internet-facing systems.
- Deploy GitLab's published detection rules (onigmo_native_worker_crash.md and org_mode_render_error_burst.md) to SIEM or log analysis platform to identify exploitation attempts in GitLab logs.
- Conduct compromise assessment on all GitLab servers: review authentication logs for anomalous access, check for unauthorized repository changes, inspect running processes and scheduled tasks for persistence mechanisms.
- If immediate patching is not possible, isolate GitLab instances from the internet behind VPN or IP allowlisting until patches can be applied.
- Review GitLab audit logs and CI/CD pipeline execution history for unauthorized jobs or configuration changes dating back to 21 October 2026.