GitLab CVE-2026-97229 Zero-Day Added to CISA KEV Under Active Exploitation
GitLab Inc. has had one actively exploited vulnerability, CVE-2026-97229, added to CISA's Known Exploited Vulnerabilities Catalog, signaling immediate and critical risk to organizations.
Key findings
- GitLab CVE-2026-97229 added to CISA KEV due to active exploitation.
- The zero-day vulnerability poses an immediate and severe threat to affected GitLab instances.
- Organizations must patch CVE-2026-97229 without delay to prevent compromise.
- CISA mandates remediation by October 29, 2026, for federal agencies.
CISA has added CVE-2026-97229, a critical vulnerability affecting GitLab Inc. products, to its Known Exploited Vulnerabilities (KEV) Catalog. This inclusion confirms that the flaw is being actively exploited in the wild, posing an immediate and severe threat to organizations utilizing affected GitLab instances. The addition underscores the urgency for defenders to address this vulnerability without delay.
Designated as CVE-2026-97229, this zero-day vulnerability represents a significant security risk. While specific exploitation details are not publicly disclosed at the time of its KEV listing, its presence in the catalog indicates that threat actors have successfully leveraged this flaw to compromise systems. Organizations should treat this as an urgent matter, as active exploitation often precedes broader attacks.
To mitigate the risk, organizations running GitLab products must prioritize patching CVE-2026-97229 immediately. CISA's KEV catalog mandates that federal civilian executive branch agencies remediate this vulnerability by October 29, 2026. All other organizations are strongly advised to follow this guidance, applying available security updates or implementing recommended mitigations to prevent potential compromise and protect their systems from ongoing threats.