CISA adds maximum-severity GitLab flaw CVE-2026-97229 to exploited vulnerabilities catalogue
CRITICAL · VULNERABILITYCVE-2026-97229redteam/daily · 4 sources
- Severity
- Critical
- Highest CVSS
- 10.0
- Exploited
- Yes
- Sources
- 4
What happened
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalogue on 29 October 2026, confirming active exploitation. The flaw affects GitLab Community Edition and Enterprise Edition, carries a CVSS score of 10.0, and allows unauthenticated remote code execution through a crafted regular expression in a CI/CD configuration. Administrators should update and not confuse this with the separate flaw CVE-2026-110264.
For IT people · Written by AI from 4 sources · Wrong?
What to do
- Update Gitlab to the fixed version for your release line (fixes CVE-2026-110264): 18.11.13, 19.0.10, 19.1.9, or see the CVE page for other lines.
- Update Gitlab to the fixed version for your release line (fixes CVE-2026-97229): 19.2.8, 19.3.5 or 19.4.2.
- CVE-2026-97229 is being exploited: treat it as urgent.
- Check whether you use Gitlab: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-110264CVSS 10.0An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to exec
- CVE-2026-97229CVSS 10.0ExploitedGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expressi
Full story timeline · 7 updates
- Tue 13 OctoberCVE-2026-97229 published, CVSS 10.0NVD
- Thu 22 OctoberCVE-2026-110264 published, CVSS 10.0NVD
- Max-severity GitLab bug allows remote code execution over 12 years of releasesThe Register (Security)
- Thu 29 OctoberCVE-2026-97229 added to CISA’s exploited listCISA KEV
- Fri 30 OctoberCISA Warns of GitLab Integer Overflow Vulnerability Exploited in AttacksCyber Security News
- Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxSecurityWeek
- CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229GBHackers
Who reported · 4 outlets
The Register (Security)Cyber Security NewsSecurityWeekGBHackers
Who and what is in it
Products