Our automated tracking framework flagged that CISA added CVE-2026-97229 (GitLab Community Edition and Enterprise Edition) to the Known Exploited Vulnerabilities (KEV) catalog on October 31, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-97229 by November 1, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-97229 |
| Vendor / product | GitLab Community Edition and Enterprise Edition |
| Vulnerability | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability |
| CVSS base score | 10 |
| Added to KEV | October 29, 2026 |
| Days public before listing (NVD → KEV lag) | 16 |
| Federal patch deadline | November 1, 2026 |
| Known ransomware use | No |
How This Compares to GitLab’s Track Record
This one was public for just 16 days before CISA confirmed exploitation — faster than GitLab’s 152-day median, meaning attackers moved unusually quickly.
| GitLab in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 6 |
| Median lag (public → KEV listing) | 152 days |
| 0-day rate (exploited at or before disclosure) | 17% |
| Entries tied to known ransomware campaigns | 1 |
For perspective, the median across all 1765 tracked KEV entries is 232 days — GitLab’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent GitLab KEV Additions
The most recent GitLab vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-85706 | Community Edition and Enterprise Edition | September 11, 2026 | -1 | No |
| CVE-2021-22175 | GitLab | February 18, 2026 | 1713 | No |
| CVE-2021-39935 | Community and Enterprise Editions | February 3, 2026 | 1513 | No |
| CVE-2023-7028 | GitLab CE/EE | May 1, 2024 | 110 | No |
| CVE-2021-22205 | Community and Enterprise Editions | November 3, 2021 | 194 | ⚠️ Yes |
What This Means for Defenders
CISA has added CVE-2026-97229, an Integer Overflow or Wraparound vulnerability in GitLab Community Edition and Enterprise Edition, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw has a critical CVSS base score of 10.0. Added to KEV on October 29, 2026, it carries a federal patch deadline of November 1, 2026. Patching is imperative for all organizations using GitLab, particularly given the confirmed exploitation and the short timeline between public disclosure and KEV listing.
This vulnerability was publicly known for only 16 days before its addition to the KEV catalog, indicating swift weaponization. Although there’s no known ransomware use, its critical severity and confirmed exploitation warrant immediate action, especially for internet-facing GitLab deployments. Don’t delay applying the patch for CVE-2026-97229.
If immediate patching before the November 1st deadline isn’t feasible, implement compensating controls. These include strict network segmentation, limiting access to GitLab instances from untrusted networks, and enhanced monitoring for unusual activity to detect and mitigate potential exploitation attempts. Proactive defense is key given the demonstrated speed of exploitation.
Related Coverage
- GitLab’s CVE-2026-85706 Was Exploited in -1 Days — Well Under Its 194-Day Median (September 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
