CISA says max severity GitLab flaw now exploited in the wild

GitLab patched an unauthenticated remote code execution vulnerability across its Community Edition and Enterprise Edition releases following confirmed adversary attacks. As detailed in BleepingComputer's report, the US Cybersecurity and Infrastructure Security Agency confirmed active wild exploitation and added the flaw to its Known Exploited Vulnerabilities catalog on Thursday. Tracked as CVE-2026-97229, the maximum-severity defect enables attackers to execute arbitrary code on vulnerable servers using a specially crafted regular expression in a CI/CD configuration file. An integer overflow weakness causes the execution failure, allowing remote attackers to compromise targeted servers without administrative credentials.

This report details the mechanics of the compiler flaw, the exposure landscape for self-managed instances, and the remediation actions mandated by federal authorities. The analysis is structured for systems administrators, DevSecOps engineers, and enterprise security professionals responsible for securing code repositories and continuous deployment infrastructure. With GitLab serving over seventy million registered users worldwide and supporting more than fifty percent of Fortune 100 organizations, unpatched instances expose software pipelines to severe supply chain compromise. Organizations managing self-hosted infrastructure must treat this vulnerability as an immediate risk to production systems and apply security patches without delay.

What broke in CISA max severity GitLab flaw now exploited

The issue broke inside GitLab's CI/CD Regular Expression Compiler, the engine component tasked with parsing, compiling, and evaluating regular expressions within pipeline configuration files. Discovered by researcher joaxcar, the flaw is an integer overflow weakness triggered during regular expression parsing. When the compiler evaluates an improperly validated regular expression supplied in a configuration file, boundary calculations fail due to insufficient expression validation. This arithmetic overflow corrupts system memory, allowing an unauthenticated remote attacker to execute arbitrary code directly on the host server without requiring valid account access.

This integer overflow marks the second critical compiler vulnerability addressed by GitLab within the same month. Earlier in October, GitLab resolved CVE-2026-110264, another maximum-severity Regular Expression Compiler defect that similarly enabled remote threat actors to execute arbitrary code on vulnerable instances. The occurrence of repeated execution vulnerabilities within the identical parsing component demonstrates persistent risks inside the CI/CD pipeline engine. Unvalidated user-supplied expressions in pipeline automation files remain a targeted attack surface for threat actors seeking unauthorized administrative control over core continuous integration and delivery server environments.

Who is exposed by CISA max severity GitLab flaw now exploited

Organizations hosting internet-accessible deployments of GitLab Community Edition and Enterprise Edition are exposed to direct exploitation. Threat intelligence organization Shadowserver tracks nearly 2,800 Internet-exposed GitLab Community Edition instances accessible online, though it is unknown how many have deployed security updates. Because Community Edition deployments frequently support independent teams without automated update pipelines, publicly exposed servers face significant exposure to automated scanning tools. Any exposed server accepting continuous integration configuration inputs from untrusted sources allows unauthenticated remote actors to reach the vulnerable evaluation compiler directly.

The exposure footprint covers global corporate enterprises and public sector agencies. GitLab's DevSecOps platform powers engineering operations for more than fifty percent of Fortune 100 organizations and supports over seventy million registered users globally. Furthermore, United States civilian executive branch agencies operating self-hosted instances fall directly under federal emergency remediation directives. While cloud-managed GitLab environments receive managed patches from the vendor, on-premises and private cloud instances running self-managed Community Edition or Enterprise Edition remain vulnerable until administrative teams complete manual patch installations.

What to do now about CISA max severity GitLab flaw now exploited

Security teams must immediately upgrade all vulnerable servers to GitLab Community Edition or Enterprise Edition versions 19.4.2, 19.3.5, or 19.2.8. GitLab remediated the integer overflow issue within these releases and urged administrators to apply the patches without delay. Additionally, GitLab released dedicated threat detections to assist self-managed customers in identifying exploitation attempts within server activity logs. Administrators should review incoming pipeline changes for anomalous regular expressions and implement network segmentation to isolate continuous integration infrastructure from public internet access.

Federal agencies must complete all remediation actions by Sunday to comply with CISA Binding Operational Directive 26-04. Although Binding Operational Directive 26-04 mandates action exclusively for federal civilian agencies, CISA strongly encouraged private sector security teams to prioritize patching immediately to defend against ongoing attacks. Systems administrators should also verify server logs against GitLab's published threat detection rules and restrict public access to administrative portals behind enterprise virtual private networks, eliminating direct internet exposure to unauthenticated pipeline parsing interfaces.

How the CISA max severity GitLab flaw now exploited issue works

The vulnerability exploits the CI/CD Regular Expression Compiler during pipeline file processing. When automated workflows execute, the compiler processes regular expressions to evaluate branch filters, tag triggers, and configuration parameters. Due to insufficient expression validation, an attacker crafting a specific regular expression triggers an integer overflow in the parsing routine. This memory flaw permits unauthenticated remote users to execute arbitrary commands with server privileges, effectively circumventing authentication layers and granting adversaries direct execution control over the underlying GitLab operating system.

GitLab confirmed the operational mechanics of the vulnerability, stating that under certain conditions, the flaw could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. Defending networks after initial compromise remains difficult; data from The Blue Report 2026 indicates that once attackers obtain valid credentials, defensive controls block only 37 percent of adversary actions across 338 million simulated production tests.

What is still unknown about CISA max severity GitLab flaw now exploited

Key operational aspects of the ongoing attacks remain unconfirmed. While Shadowserver identified nearly 2,800 Internet-exposed GitLab Community Edition servers, the data does not reveal how many have implemented patches. Neither CISA nor GitLab has named the specific threat actors conducting the intrusions, nor have they published details regarding the geographic origin of the attacks. It remains unknown how many organizations have experienced successful intrusions, when initial exploitation commenced prior to disclosure, or what specific secondary payloads adversaries deploy after compromising vulnerable servers.

The exploitation follows a series of serious vulnerabilities resolved by GitLab this year. In January, GitLab patched CVE-2026-0723, a high-severity flaw allowing attackers knowing a target's account ID to bypass two-factor authentication. Earlier this month, the vendor addressed CVE-2026-85706 in the repository commits API, which allowed attackers to read sensitive credentials and secrets; watchTowr reported internet scanning, prompting CISA to add it to the catalog the next day. These join CVE-2021-22175 and CVE-2021-39935 from February, bringing the total to six GitLab flaws flagged by CISA as actively exploited since November 2021.