bleeping-computer Nov 2, 2026 · Crawled Nov 3, 2026

Over 1,000 GitLab servers vulnerable to ongoing RCE attacks

4 CVEs

AI Summary

A critical remote code execution vulnerability, CVE-2026-97229, in GitLab's CI/CD Regular Expression Compiler is actively being exploited in the wild. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable GitLab servers by submitting a specially crafted regular expression in a CI/CD configuration. Despite patches released by GitLab for versions 19.4.2, 19.3.5, and 19.2.8, over 1,000 internet-exposed GitLab instances remain unpatched and are currently under attack. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to remediate it immediately.

AI-extracted · verify before operational use

Extracted Entities 4 found

CVE CVE-2026-97229 → CVE CVE-2026-0723 → CVE CVE-2026-85706 → CVE CVE-2026-110264 →

MITRE ATT&CK TTPs 4 techniques

T1059 Command and Scripting Interpreter · Execution T1133 External Remote Services · Persistence T1203 Exploitation for Client Execution · Execution T1210 Exploitation of Remote Services · Lateral Movement