CISA reports active exploitation of critical GitLab vulnerability

The Cybersecurity and Infrastructure Security Agency reported that attackers have begun exploiting a maximum-severity GitLab vulnerability tracked as CVE-2026-97229. This flaw stems from an integer overflow weakness in the CI/CD Regular Expression Compiler, allowing unauthenticated users to execute arbitrary code via specially crafted regular expressions. GitLab remediated the issue in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8. The agency added the vulnerability to its Known Exploited Vulnerabilities Catalog on Thursday.

CISA ordered federal agencies to secure their servers by Sunday under Binding Operational Directive 26-04. The agency also encouraged private sector security teams to prioritize patching this flaw. GitLab released threat detections to support customers with self-managed instances after detecting exploitation attempts. Shadowserver tracks nearly 2,800 Internet-exposed GitLab Community Edition instances but did not state how many have been secured.

This incident is the latest in a series of security issues GitLab has addressed since the start of the year. In January, the company patched a high-severity two-factor authentication bypass vulnerability. CISA has tagged six GitLab vulnerabilities as exploited in the wild since November 2021.