Affected Systems
GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Vulnerability tracked as CVE-2026-110264. Over 2,700 GitLab CE instances exposed online. Affects on-premises installations; GitLab.com and GitLab Dedicated (19.3.5-internal0 and 19.4.2-internal0+) already patched.
Exploitation Status
No active exploitation reported. Vulnerability disclosed through HackerOne bug bounty program by researcher 'joaxcar'. No public PoC available at time of disclosure. However, GitLab has history of rapid exploitation (CVE-2026-85706 exploited within days, added to CISA KEV).
Business Impact
Unauthenticated remote code execution on GitLab servers via integer overflow in Regular Expression Compiler. Attackers can achieve full server compromise without credentials. High-value target: GitLab used by 50% of Fortune 100 companies and hosts source code, CI/CD pipelines, credentials, and secrets. Given GitLab's recent exploitation history (5 KEV entries since 2021, including ransomware attacks), rapid weaponization is likely. Over 2,700 internet-exposed instances create significant attack surface.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade all GitLab CE/EE instances to patched versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13
- Verify GitLab Dedicated tenants are running 19.3.5-internal0, 19.4.2-internal0, or later
- Review GitLab access logs for suspicious unauthenticated requests targeting configuration file parsing or regex validation endpoints
- Restrict network access to GitLab instances using firewall rules or VPN; remove unnecessary internet exposure
- Monitor for follow-on exploitation attempts given CVE-2026-85706 was added to CISA KEV within one month and GitLab's history of active exploitation