Affected Systems
GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.4.2, 19.3.5, and 19.2.8. Over 1,000 internet-exposed self-managed GitLab instances remain vulnerable. GitLab.com and GitLab Dedicated are patched.
Exploitation Status
Active exploitation confirmed by CISA. CVE-2026-97229 added to CISA KEV catalog on November 1, 2026. Shadowserver tracking 1,000+ vulnerable instances exposed online. Patches released October 12, 2026.
Business Impact
Maximum-severity unauthenticated remote code execution via crafted regular expressions in CI/CD pipeline configuration files. Integer overflow in Regular Expression Compiler allows arbitrary code execution on GitLab servers. Federal agencies under CISA directive to patch by November 3, 2026. GitLab platform used by 70M+ users and 50%+ of Fortune 100 companies. High risk of credential theft, lateral movement, and supply chain compromise through CI/CD infrastructure.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade self-managed GitLab CE/EE instances to version 19.4.2, 19.3.5, or 19.2.8 depending on your release track
- Audit GitLab server logs for suspicious CI/CD pipeline activity, unusual regular expressions in .gitlab-ci.yml files, and unauthorized code execution since October 12, 2026
- Verify GitLab instances are not directly exposed to the internet; place behind VPN or implement IP allowlisting for CI/CD operations
- Review and rotate credentials, API tokens, and secrets accessible from GitLab servers that may have been compromised
- Monitor for CVE-2026-110264 exposure (11,300+ vulnerable instances tracked) and apply patches for this related Regular Expression Compiler RCE flaw