Over 1,000 GitLab Servers Remain Unpatched Against Active RCE Attacks

More than 1,000 Internet-exposed GitLab servers remain unpatched against a maximum-severity remote code execution (RCE) vulnerability that is currently being exploited in the wild.

The flaw, identified as CVE-2026-97229, stems from an integer overflow weakness within the CI/CD Regular Expression Compiler. This specific component is responsible for parsing and evaluating regular expressions used in pipeline configuration files.

The United States Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of the vulnerability and has added it to its Known Exploited Vulnerabilities (KEV) Catalog. CISA has ordered federal agencies to secure their affected servers by Sunday.

Unpatched Instances and Active Exploitation

Although GitLab released security patches several weeks ago, the threat intelligence firm Shadowserver reported that over 1,000 unpatched GitLab servers are still exposed to ongoing attacks. Shadowserver also identified approximately 11,300 instances vulnerable to a separate maximum-severity Regular Expression Compiler bug, CVE-2026-110264.

GitLab stated that the vulnerability could allow an unauthenticated user to execute arbitrary code on a server via a specially crafted regular expression in a CI/CD configuration, caused by insufficient validation of the expression.

Required Remediation

GitLab has provided fixes for both GitLab Community Edition (CE) and Enterprise Edition (EE). All organisations running self-managed GitLab installations should upgrade to one of the following versions immediately to mitigate the risk:

• 19.4.2
• 19.3.5
• 19.2.8

GitLab confirmed that GitLab.com is already running the patched version and that GitLab Dedicated customers do not need to take any action.

This vulnerability follows a series of significant security issues for the platform throughout the year. These include a January flaw that enabled two-factor authentication bypass and a maximum-severity vulnerability in the repository commits API, identified in September, which could be exploited to steal credentials and other secrets.