Advisories
Critical GitLab CE/EE Vulnerability (CVE-2026-97229) – Immediate Upgrade Required
An integer‑overflow flaw in GitLab’s CI/CD regex compiler (CVE‑2026‑97229) allows unauthenticated code execution on self‑managed instances. All GitLab Community and Enterprise Editions older than 19.4.2, 19.3.4, or 19.2.8 must be patched immediately, prioritizing internet‑facing deployments.
What happened
A flaw in the CI/CD regular‑expression compiler triggers an integer overflow when processing a crafted expression, enabling an unauthenticated attacker to execute arbitrary code on the GitLab server. The issue is catalogued as CVE‑2026‑97229 and carries a CVSS score of 10.0.
Impact
- All self‑managed GitLab Community Edition and Enterprise Edition releases before 19.4.2, 19.3.4, or 19.2.8 are vulnerable.
- Additional critical bugs fixed in the same release include CVE‑2026‑92883 (cross‑site scripting via syntax highlighting), CVE‑2026‑16301 (pipeline privilege escalation), and a cache‑poisoning flaw that could expose protected CI/CD variables.
What to do
- Upgrade immediately to GitLab 19.4.2 (CE/EE), 19.3.4, or 19.2.8.
- Prioritize internet‑facing instances; restrict external access to the GitLab API and web UI until patched.
- Verify the upgrade by checking the version string and reviewing audit logs for unexpected pipeline activity.
- Apply least‑privilege controls on CI/CD variables and review repository permissions to mitigate residual risk.
Additional context
GitLab’s patch notes indicate the vulnerability stemmed from weak validation of regular expressions in the CI/CD compiler. The fix removes the integer‑overflow path and hardens input handling.
Related vulnerabilities
GitLab CVE-2026-97229: Unauthenticated Remote Code Execution via CI/CD Regex Overflow
A critical integer overflow in GitLab’s CI/CD regex compiler allows unauthenticated remote code execution on self‑managed instances. Attackers must first inject a malicious .gitlab-ci.yml into a public repository. Immediate patching of all unpatched GitLab CE/EE deployments is required.
Read briefing
GitLab Urges Immediate Patch for CVE‑2026‑85706 Path Traversal Flaw – Attackers Already Scanning
GitLab has released critical security updates for two high‑severity bugs: CVE‑2026‑85706, an unauthenticated path traversal that can expose arbitrary files, and CVE‑2026‑87719, an insecure deserialization flaw that lets privileged users harvest credentials. The first flaw was discovered by researcher s3ntago via GitLab’s HackerOne program, and watchdog firm watchTowr reports attackers are already probing exposed instances. All self‑managed GitLab installations must upgrade to the patched 19.3.2/19.2.6/19.1 releases immediately. The platform serves over 30 million users, including more than 50%
Read briefing
Schneider Electric PowerChute Serial Shutdown Vulnerability (CVE‑2026‑13348) – Immediate Patch Required
Schneider Electric’s PowerChute Serial Shutdown UPS management software is affected by a CVE‑2026‑13348 flaw that allows unlimited authentication attempts when redirect handling is disabled. The issue could enable attackers to bypass login controls and disrupt critical infrastructure operations. Versions up to 1.5 and 1.6 are impacted; the vendor’s v1.6 patch restores proper authentication limits. Operators must download and install the update for Windows and Linux immediately, then verify the new version via the Control Panel or PCSS About page.
Read briefing
SAP Exposes Critical Kernel & Message Server Flaws: CVE-2026-44756 & CVE-2026-58240
SAP’s September Security Patch Day revealed two critical vulnerabilities that can be exploited remotely without authentication. The memory‑corruption flaw in SAP Extended Passport (OVERPASS, CVE‑2026‑44756) and the missing‑auth bug in NetWeaver Message Server (S4GET, CVE‑2026‑58240) both allow attackers to run arbitrary OS commands as the SAP installation user, risking full system takeover. Immediate application of SAP Security Notes 3747649 and 3759472 is mandatory.
Read briefing