Attackers have commenced exploiting a maximum-severity **GitLab** vulnerability, **CVE-2026-97229**, patched earlier this month. This critical security flaw was first identified by a security researcher known as 'joaxcar' within the CI/CD Regular Expression Compiler, which processes regular expressions in pipeline configuration files. ### The Vulnerability: CVE-2026-97229 **CVE-2026-97229** is rooted in an integer overflow weakness. It could enable remote attackers to execute arbitrary code on targeted instances. This is achieved through a maliciously crafted regular expression in a CI/CD configuration, bypassing insufficient expression validation. **GitLab**'s official statement clarified: "**GitLab** has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the **GitLab** server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation." ### Patching and CISA's Mandate **GitLab** promptly addressed this issue in **GitLab** Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. The company has strongly urged administrators to apply these patches without delay. Furthermore, **GitLab** has rolled out threat detections to assist customers with self-managed instances in identifying and responding to exploitation attempts. On Thursday, **CISA** officially confirmed the active exploitation of **CVE-2026-97229**, adding it to its Known Exploited Vulnerabilities (**KEV**) Catalog. In line with Binding Operational Directive (BOD) 26-04, **CISA** has ordered all federal agencies to secure their servers by Sunday. While this directive specifically targets federal entities, **CISA** has extended its recommendation to all security teams, including those in the private sector. Prioritizing the patching of this flaw is crucial to protect networks against ongoing attacks. ### Scope of Exposure Internet threat watchdog **Shadowserver** currently tracks nearly 2,800 Internet-exposed **GitLab** Community Edition instances. However, the exact number of instances that have been secured against these attacks remains unclear.  ### A Pattern of Critical Flaws **CVE-2026-97229** is the latest in a series of significant security issues addressed by **GitLab** this year. In January, the company patched **CVE-2026-0723**, a high-severity two-factor authentication bypass. This flaw allowed attackers, with knowledge of a target's account ID, to circumvent 2FA. Earlier this month, another maximum-severity Regular Expression Compiler flaw, **CVE-2026-110264**, was fixed. This vulnerability also enabled remote attackers to execute arbitrary code on targeted instances. Just two weeks later, **GitLab** addressed **CVE-2026-85706**, a maximum-severity path traversal flaw in the repository commits API. This could be abused to read sensitive data, including credentials and other secrets, from vulnerable servers. **CISA** added **CVE-2026-85706** to its list of actively exploited flaws shortly after the cybersecurity firm **watchTowr** reported active scanning for unpatched **GitLab** servers. Since November 2021, **CISA** has identified six **GitLab** vulnerabilities as actively exploited in the wild, including **CVE-2021-22175** and **CVE-2021-39935** earlier this year. **GitLab**'s DevSecOps platform is a cornerstone for over 50% of Fortune 100 companies, serving more than 70 million registered users globally. The ongoing exploitation highlights the critical need for immediate patching across its vast user base.