GoKawiilCISA confirms active exploitation of critical GitLab CI/CD flaw CVE-2026-97229
CISA added CVE-2026-97229, a maximum-severity GitLab vulnerability, to its Known Exploited Vulnerabilities catalog after confirming attackers are exploiting it in the wild. The flaw, an integer overflow in GitLab's regular expression compiler, lets unauthenticated attackers run arbitrary code via crafted CI/CD configurations; GitLab patched it in versions 19.4.2, 19.3.5 and 19.2.8 earlier this month.
GoKawiil's interpretation of the reporting above, not reported fact.
CISA's directive forces federal agencies to patch by a strict deadline, underscoring how severe the agency considers the risk of unauthenticated remote code execution on exposed GitLab servers. With nearly 2,800 internet-facing GitLab Community Edition instances tracked by Shadowserver, the real-world attack surface could be substantial if organizations outside government delay patching.
- CVE-2026-97229 is a maximum-severity, unauthenticated remote code execution flaw in GitLab's CI/CD regex compiler.
- CISA confirmed active exploitation and ordered federal agencies to patch by Sunday under BOD 26-04.
- Nearly 2,800 internet-exposed GitLab Community Edition instances remain tracked, with patch status unclear.
Source: bleepingcomputer.com, 2026-10-30
Published there as: “CISA says max severity GitLab flaw now exploited in the wild”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.