Over 1,000 GitLab servers vulnerable to ongoing RCE attacks

Threat actors have begun launching active remote code execution attacks against more than 1,000 internet-exposed GitLab servers that remain unpatched against a maximum-severity security flaw. According to BleepingComputer's report, the vulnerability allows unauthenticated attackers to execute arbitrary system code on vulnerable host instances by exploiting an underlying flaw in pipeline processing. Security agencies and independent telemetry networks have confirmed that malicious activity targeting these vulnerable systems is already underway across public internet infrastructure.

This technical advisory details the root mechanism behind the vulnerability, the specific software builds required for remediation, and the historical pattern of exploitation affecting enterprise source repositories. The guidance is intended for system administrators, DevOps leads, and security operations personnel responsible for maintaining self-managed deployments of the GitLab DevSecOps platform. Immediate assessment of boundary firewalls and patch levels across all public-facing repository infrastructure is critical to prevent complete administrative takeover and subsequent data theft.

What broke in Over 1

The underlying failure stems from an integer overflow vulnerability discovered within GitLab's CI/CD Regular Expression Compiler, which parses and evaluates complex expressions defined in pipeline configuration files. Under specific operating conditions, the parsing logic fails to validate input lengths properly, creating a memory management breakdown during expression evaluation. Because the compiler processes continuous integration parameters before session authentication is established, unauthenticated remote attackers can send specially crafted regular expressions inside pipeline files to force arbitrary machine instructions onto the underlying host server.

GitLab remediated the problem across its release branches on October 12 by issuing security patches for Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8. The company confirmed that insufficient regular expression validation enabled the remote code execution attack vector. The disclosure marked the second time in recent weeks that the platform's Regular Expression Compiler required urgent patching, following an earlier maximum-severity vulnerability tracked as CVE-2026-110264 that similarly permitted remote adversaries to trigger unauthenticated code execution on unpatched target servers worldwide.

Who is exposed by Over 1

Threat intelligence organization Shadowserver disclosed over the weekend that tracking telemetry identified more than 1,000 vulnerable GitLab servers reachable over the public internet. Those exposed hosts represent a subset of the approximately 39,000 GitLab instances observed daily across global networks, leaving a significant attack surface accessible to malicious scanning engines. The exposure is particularly dangerous for self-managed enterprise servers that have not applied updates released over three weeks ago, as automated reconnaissance scripts continuously probe exposed endpoints for pipeline parser weaknesses.

The operational footprint of the software amplifies the systemic risk, as GitLab currently supports over 70 million registered users and provides core engineering infrastructure to more than 50 percent of Fortune 100 enterprises worldwide. While customers utilizing the cloud-hosted GitLab.com platform are protected because patches were applied directly by GitLab engineering, self-hosted deployments remain entirely dependent on internal maintenance cycles. Organizations running isolated GitLab Dedicated single-tenant cloud environments are also safe from this flaw and require no manual remediation steps from their engineering teams.

What to do now about Over 1

Enterprise engineering teams operating self-managed GitLab infrastructure must immediately update their installations to Community Edition or Enterprise Edition versions 19.4.2, 19.3.5, or 19.2.8 depending on their active release track. GitLab strongly urged all administrators running self-managed environments to deploy the respective point releases without delay to neutralize active intrusion vectors. Because automated exploitation scripts require direct network reachability to repository configurations, teams unable to upgrade immediately should restrict external ingress to internal networks or require secure virtual private network gateways for access.

The urgency was reinforced on Friday when the United States Cybersecurity and Infrastructure Security Agency formally placed CVE-2026-97229 on its Known Exploited Vulnerabilities Catalog following confirmed in-the-wild exploitation. Under binding operational directives, CISA ordered all civilian federal executive branch agencies to patch or isolate their vulnerable instances by Sunday. Enterprise security teams outside the federal government should follow the same rapid timeline, checking server logs for anomalous regular expression evaluations or unrecognized CI/CD pipeline runs executed by unauthenticated source addresses across network boundaries.

How the Over 1 issue works

The vulnerability functions by abusing automated compilation routines that handle syntax parsing inside GitLab CI/CD configurations. When a user defines automated workflow rules, the pipeline engine passes regular expressions to an internal parsing module to evaluate branch names, commit patterns, and variable triggers across projects. Because the engine suffers from an unchecked integer calculation, supplying an oversized or maliciously structured expression causes numeric wrapping in memory allocation tables, overwriting adjacent memory space with attacker-controlled shellcode that executes with server application privileges on the host.

This compromise mechanism fits into an expanding sequence of severe access flaws uncovered across GitLab components since January. Early in the year, developers patched CVE-2026-0723, a high-severity bug enabling adversaries to bypass two-factor authentication safeguards, followed in September by CVE-2026-85706, a maximum-severity flaw inside the repository commits API. Cybersecurity firm watchTowr documented active adversary scanning against the commits API immediately after disclosure, illustrating how quickly threat actors weaponize architectural vulnerabilities to extract credentials, commit histories, and proprietary source materials from exposed repositories.

What is still unknown about Over 1

Security analysts have not yet publicly attributed the active exploitation campaigns to specific advanced persistent threat actors or cybercrime syndicates. Forensic investigations remain ongoing regarding whether threat actors are using the flaw purely for reconnaissance, credential harvesting, or secondary payload deployment. Historical precedent suggests severe risks, as CISA has recorded six distinct GitLab flaws in its catalog of actively abused vulnerabilities since November 2021, with at least one historical flaw ultimately being leveraged to deploy disruptive enterprise ransomware campaigns across compromised corporate networks.

Widespread patching delays also obscure the true breadth of organizational compromise, as telemetry data from Shadowserver highlights that more than 11,300 servers still run software vulnerable to the older CVE-2026-110264 regular expression flaw. It remains uncertain how many unpatched servers have already suffered silent intrusions or backend data exfiltration prior to remediation attempts. Incident response teams must continue analyzing internal host environments for persistent web shells, abnormal daemon spawning, or unauthorized access tokens generated during the multi-week window following initial patch availability.