CISA Confirms Active Exploitation of Maximum-Severity GitLab Vulnerability

CISA announced on Thursday that active exploitation of CVE-2026-97229 has begun, adding the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. The flaw affects GitLab's CI/CD Regular Expression Compiler. Discovered by a security researcher using the handle 'joaxcar,' the vulnerability stems from an integer overflow weakness. This weakness allows remote attackers to run arbitrary code on targeted instances if they can craft a malicious regular expression within a CI/CD configuration. GitLab previously addressed the security issue, stating that the flaw could allow an unauthenticated user to execute arbitrary code due to insufficient regular expression validation. The company released patches for GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8, urging administrators to secure their servers immediately. In addition to the patch, GitLab has released threat detections to assist customers operating self-managed instances after detecting exploitation attempts. CISA has mandated that federal agencies secure their servers against this threat by Sunday, as required by Binding Operational Directive (BOD) 26-04. While this directive targets federal entities, CISA strongly encourages all private sector security teams to prioritize patching the flaw to mitigate ongoing attacks. CVE-2026-97229 is part of a series of high-severity security issues GitLab has addressed since the beginning of the year. Previous vulnerabilities included a two-factor authentication bypass (CVE-2026-0723) and a maximum-severity flaw in the repository commits API that could expose sensitive data like credentials (CVE-2026-85706).