9 Exploit-Feed Entries Precede CVE-2026-97229 GitLab RCE

PurpleOps data records 9 exploit-feed entries for CVE-2026-97229, an integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition. The first exploit-feed entry appeared on 2026-10-13, exactly 16 days before the Cybersecurity and Infrastructure Security Agency added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-29.

Who is affected?

The National Vulnerability Database assigns CVE-2026-97229 the CWE-190 weakness class for integer overflow or wraparound. The flaw allows an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H means the vulnerability is reachable over the network, requires no privileges and no user interaction, has low attack complexity, and causes a total loss of confidentiality, integrity, and availability.

The configuration data lists specific vulnerable ranges. Builds at or above a fixed version are not affected. The affected software includes: * Gitlab Gitlab Community Edition from 19.2.0 before 19.2.8 * Gitlab Gitlab Enterprise Edition from 19.2.0 before 19.2.8 * Gitlab Gitlab Community Edition from 19.3.0 before 19.3.5 * Gitlab Gitlab Enterprise Edition from 19.3.0 before 19.3.5 * Gitlab Gitlab Community Edition from 19.4.0 before 19.4.2 * Gitlab Gitlab Enterprise Edition from 19.4.0 before 19.4.2 * Ruby-Lang Ruby from 3.3.0 before 3.3.13 * Ruby-Lang Ruby from 3.4.0 before 3.4.12 * Ruby-Lang Ruby from 4.0.0 before 4.0.8

Defenders tracking risk across this platform must also monitor previous incidents, as CVE-2026-1868 (CVSS 9.9) Exploits GitLab AI Gateway for RCE remains a known risk factor in related environments.

Is CVE-2026-97229 being exploited?

CISA confirmed exploitation when adding the vulnerability to the Known Exploited Vulnerabilities catalog. PurpleOps assigns the vulnerability a risk score of 90/100 based on ease of use, potential impact, how widely the vulnerability could spread, and whether special access or user actions are needed.

The PurpleOps analysis report classifies the analyzed artifact, a file named tests/test_ci_lint.py, as tooling. The file contains Python unittest-based tests for the CI lint wrapper in tools.ci_lint. The code verifies correct construction of the API request, checking the endpoint, method, and payload, and confirms the response parsing yields the expected structure using a mocked HTTP response. The artifact demonstrates no exploit behavior and targets the correct usage and reliability of the tooling around the CI Lint API. Weaponization complexity for this specific file is trivial because the test code relies on straightforward function calls and mocks without any exploitation logic.

PurpleOps recorded 5 news articles mentioning the vulnerability in the 7 days to 2026-11-05.

How do I detect it?

No indicators of compromise appear in the public reporting we collected. Defenders must use behavioral hunt leads to identify exploitation. The primary hunt lead is the service process starting an interpreter or shell. Security teams must monitor web or application access logs for the affected service, keeping them at full request detail. Analysts must also collect process creation logs for the hosts running the service, specifically Sysmon event 1 on Windows or auditd execve on Linux, along with outbound network connection logs from those hosts.

Additional hunt leads include files written into directories the service can execute from and outbound connections from the service host to addresses it has never contacted before. If a hunt lead hits, responders must capture the service logs and a memory image before restarting the service. Teams must also rotate the credentials and tokens the service host held and compare the service files against a known-good deployment before returning the software to production.

Security teams can use the following Sigma rule as a starting detection to tune for their environment. To tune the rule and avoid false positives, defenders must allow-list the maintenance jobs that legitimately run under the service account, by command line.

title: Web Service Process Spawning a Shell or Interpreter
id: a50869ab-edeb-46b0-96ca-df4922bdb116
status: experimental
description: Detects a web server or application server process starting a shell or scripting interpreter, the first observable step after remote code execution in a web application.
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\java.exe'
      - '\node.exe'
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/java'
      - '/node'
  selection_parent_php:
    ParentImage|contains: '/php-fpm'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python3'
      - '/perl'
  condition: (selection_parent or selection_parent_php) and selection_child
falsepositives:
  - Application maintenance or deployment scripts launched by the web service account
level: high

What should I patch first?

CISA requires federal agencies to apply mitigations in accordance with vendor instructions by the remediation due date of 2026-11-01. The mandate requires ensuring compliance with CISA BOD 26-04 Prioritizing Security Updates Based on Risk guidance and Forensics Triage Requirements. Agencies must follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.

Security teams can use JINX to query their logs automatically and identify behavioral patterns associated with CVE-2026-97229 exploitation. Find out more about how PurpleOps products assist threat hunters by reading about our AI analysts.