Over 1,000 GitLab Servers Remain Exposed to Active Exploitation Weeks After Patch (CVE-2026-97229)

Scope: Self-managed GitLab Community Edition and Enterprise Edition, instances not yet updated against CVE-2026-97229

Severity: Red

CISA confirmed active exploitation of CVE-2026-97229, a maximum severity integer overflow in GitLab’s CI/CD Regular Expression Compiler, and added it to its Known Exploited Vulnerabilities catalog with a federal deadline that has already passed. Despite that, internet scanning firm Shadowserver reported on November 2 that over 1,000 internet-exposed GitLab instances remain vulnerable to this specific flaw, and more than 11,300 instances remain vulnerable to a related maximum severity regex compiler flaw from last month, CVE-2026-110264, out of roughly 39,000 GitLab servers the firm observes daily. This marks the third maximum severity vulnerability in GitLab’s regex compiler patched within the span of under a month, following earlier incidents we have covered, a pattern that suggests the underlying component deserves particular scrutiny from anyone running self-managed GitLab. Because the exposed instance count has barely moved despite public confirmation of active exploitation and a passed federal deadline, this looks less like a difficult technical fix and more like a patching backlog many organisations have simply not gotten to yet. Organisations running self-managed GitLab must update to a patched release today if this has not already happened, and should not assume exposure is unlikely simply because the flaw has been public for weeks, the scanning data shows real attackers are actively working through the same exposed population.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.