Over 1,000 Internet-Exposed GitLab Servers Remain Unpatched Against Actively Exploited RCE Flaw

More than 1,000 Internet-exposed GitLab servers remain unpatched against a maximum-severity vulnerability that is being actively exploited in remote code execution attacks, according to threat watchdog Shadowserver, despite security fixes having been available for three weeks. The flaw, tracked as CVE-2026-97229, stems from an integer overflow weakness in the CI/CD Regular Expression Compiler, a component that parses and evaluates regular expressions in pipeline configuration files. GitLab disclosed the issue on October 12, when it released patches for GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company said at the time of the patch release. GitLab urged all self-managed installations to upgrade to one of the patched versions immediately, noting that GitLab.com was already running the fixed version and that GitLab Dedicated customers did not need to take action. On Friday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers have begun exploiting the flaw in the wild. The agency added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to secure their servers by Sunday. Shadowserver revealed over the weekend that it is tracking more than 1,000 unpatched GitLab instances vulnerable to CVE-2026-97229. The organization also reported over 11,300 instances vulnerable to CVE-2026-110264, a separate maximum-severity Regular Expression Compiler bug patched last month that allows threat actors to run arbitrary code on targeted instances. Shadowserver said it observes around 39,000 GitLab instances daily. CVE-2026-97229 is the latest in a series of GitLab security issues addressed this year. In January, GitLab fixed a high-severity flaw, CVE-2026-0723, that allowed attackers to bypass two-factor authentication. In September, the company patched a maximum-severity vulnerability, CVE-2026-85706, in the repository commits API that could be exploited to steal credentials and other secrets. CISA also flagged that flaw as actively abused after cybersecurity firm watchTowr reported attackers scanning for vulnerable GitLab servers. Since November 2021, CISA has added six GitLab flaws to its catalog of actively exploited vulnerabilities, one of which has also been used in ransomware attacks. GitLab says its DevSecOps platform has more than 70 million registered users and is used by over 50% of Fortune 100 companies worldwide, making the continued exposure of unpatched servers a significant concern for organizations running self-managed instances.