CISA Adds GitLab CVE-2026-97229 to KEV List Amid Exploitation Concerns

## Overview CISA has added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) list. This vulnerability affects GitLab Community Edition and Enterprise Edition, impacting versions prior to 19.2.8, 19.3.5, and 19.4.2. The addition comes amid evidence of exploitation attempts. Unauthenticated users can potentially execute arbitrary code on affected GitLab servers through specially crafted regular expressions in CI/CD configurations. ## Technical Details CVE-2026-97229 is classified as an integer overflow or wraparound vulnerability. It arises from insufficient validation of regular expressions. Attackers can exploit this flaw by submitting malicious input in CI/CD configurations. This could lead to remote code execution, allowing attackers to gain control over the server. ## Impact The vulnerability has a CVSS score of 10.0, indicating critical severity. Successful exploitation could lead to significant security breaches. Organizations using affected versions of GitLab are at risk of unauthorized access and potential data compromise. The ability for unauthenticated users to execute code raises serious concerns for operational integrity. ## Mitigation Defenders should immediately update their GitLab installations to versions 19.2.8, 19.3.5, or 19.4.2 or later. Regularly review CI/CD configurations for any suspicious activity or unauthorized changes. Implement additional security measures such as network segmentation and access controls to limit exposure. Monitoring logs for unusual patterns can also help detect potential exploitation attempts.