■ ARISTA CVE-2026-114625 · Fixed■ CISCO CVE-2026-76519 · Fixed■ CITRIX CVE-2026-88779 · Fixed■ COLLABORA CVE-2026-110447 · Fixed■ FORTINET CVE-2026-104286 · Fixed■ GITLAB CVE-2026-97229 · Fixed■ MICROSOFT KB5127648 · Confirmed by Microsoft (Oct 20)■ MICROSOFT KB5127648 · Fixed in October 13 updates■ ORACLE CVE-2026-75803 · Released 2026-10-20■ PALO ALTO CVE-2026-0322 · Fixed■ PALO ALTO CVE-2026-109618 · Fixed■ PLEX CVE-2026-96652 · Fixed■ SAP GHSA-4mv3-jxxm-9cx2 · Patches released 2026-10-13■ SONICWALL CVE-2026-19868 · Fixed■ VMWARE/BROADCOM KB 455737 · No critical release in October■ MICROSOFT KB5124010 · Mitigated (workaround only■ WORDPRESS CVE-2026-119977 · Fixed

← All impacts

GitLab

GitLab CE/EE: exploited unauthenticated RCE via CI/CD regexp compiler (CVE-2026-97229)

Fixed

TL;DR: CVE-2026-97229 is a CVSS 10.0 integer overflow in GitLab's CI/CD regular-expression compiler. Under certain conditions an unauthenticated attacker can run code on the GitLab server through a crafted CI/CD configuration. GitLab fixed it on Oct 12 in 19.4.2, 19.3.5 and 19.2.8. CISA added it to KEV on Oct 29. Self-managed instances should upgrade now. GitLab.com and Dedicated were already patched. (GitLab, CISA)

Item Detail Source
CVE / severity CVE-2026-97229, Critical, CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) GitLab
Affected GitLab CE/EE: all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 GitLab
Impact Integer overflow in the CI/CD regexp compiler; unauthenticated code execution on the server via a crafted CI/CD configuration GitLab
Exploitation CISA added CVE-2026-97229 to KEV on Oct 29, 2026, citing evidence of active exploitation. Federal due date: Nov 1, 2026. Forensic triage required under BOD 26-04 CISA alert, CISA KEV
Fixed in 19.4.2, 19.3.5, 19.2.8 (released Oct 12, 2026). GitLab.com already patched; Dedicated tenants patched before public release GitLab
Related Ruby fix Same Onigmo integer-overflow class fixed in Ruby 4.0.8+, 3.4.12 and 3.3.13 Ruby

What to do

  • Upgrade self-managed GitLab CE/EE to 19.4.2, 19.3.5 or 19.2.8, matching your release train. (GitLab)
  • GitLab's published fix is the upgrade. Until then, MoonSec analysis: limiting who can create or write public projects on a self-managed instance can shrink one common delivery path; it does not patch the compiler.
  • GitLab published six detection rules for self-managed operators: Onigmo native worker crash; Graphql cilint hostile regexp; ci regexp oversized non ascii path; ci regexp guard rejection; ci lint workhorse worker crash; ci lint scripted client error burst. (GitLab)

Why it matters

MoonSec analysis: A CVSS 10.0, unauthenticated path into the GitLab application worker, now on KEV, belongs at the front of the patch queue for any internet-reachable self-managed instance. SaaS and Dedicated customers are already on fixed builds; self-managed fleets are the remaining exposure.

Last verified 2026-11-05Report an error: [email protected]