Over 1,000 GitLab servers are still unpatched against a critical remote code execution vulnerability, CVE-2026-97229, according to Shadowserver. This flaw, an integer overflow in the CI/CD Regular Expression Compiler, allows unauthenticated users to execute arbitrary code.
GitLab addressed the vulnerability by releasing patches for versions 19.4.2, 19.3.5, and 19.2.8 on October 12. Despite this, many servers remain exposed, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog and mandate federal agencies to secure their systems by Sunday.
Shadowserver's scans revealed over 1,000 vulnerable instances to CVE-2026-97229, and more than 11,300 instances vulnerable to another flaw, CVE-2026-110264, out of approximately 39,000 GitLab instances scanned daily.
GitLab.com had already implemented the necessary patches at the time of their release. However, self-managed GitLab installations have been strongly urged to upgrade immediately to mitigate potential risks.