CISA says max severity GitLab flaw now exploited in the wild

CISA has confirmed that attackers are actively exploiting a maximum-severity GitLab vulnerability, CVE-2026-97229, which was patched earlier this month. The flaw, an integer overflow in the CI/CD Regular Expression Compiler, lets an unauthenticated attacker run arbitrary code on a vulnerable GitLab server by submitting a maliciously crafted regular expression inside a CI/CD pipeline configuration. GitLab fixed the issue in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8, and has rolled out detection rules after spotting exploitation attempts against self-managed instances. Following CISA's addition of the bug to its Known Exploited Vulnerabilities catalog, federal agencies must remediate by Sunday under Binding Operational Directive 26-04, while all organizations running GitLab—used by more than half of Fortune 100 companies—are urged to patch immediately given that thousands of instances remain exposed online.