GitLab patches critical unauthenticated RCE flaw in Community and Enterprise editions

GitLab released a security advisory on 21 October 2026 addressing a critical vulnerability that allows unauthenticated users to execute arbitrary code on affected servers. The European Union Agency for Cybersecurity (CERT-EU) published an official advisory recommending that organizations update their assets immediately, prioritizing those exposed to the internet.

The primary flaw, identified as CVE-2026-110264, carries a CVSS score of 10 and is classified as critical. According to the CERT-EU advisory, the issue stems from an integer overflow within the regular expression compiler. This technical defect enables attackers to run arbitrary code on the server without needing valid credentials, representing a severe risk to infrastructure integrity.

Context and Background

In addition to the critical remote code execution flaw, GitLab addressed several other security issues in the same update. The vendor fixed two high-severity vulnerabilities, five medium-severity issues, and four low-severity defects. The CERT-EU advisory highlights the critical nature of CVE-2026-110264 specifically, noting its potential for unauthenticated exploitation as the primary driver for urgent action.

GitLab has also published two detection rules to help security teams identify active exploitation attempts. These rules target specific indicators associated with the regular expression compiler crash and rendering errors. Organizations can use these signatures to monitor their environments for signs of compromise or ongoing attack activity related to this specific vulnerability.

Who Is Affected

The vulnerability impacts specific versions of both GitLab Community Edition and GitLab Enterprise Edition. The CERT-EU advisory states that the flaw affects the versions listed in GitLab’s official patch release documentation. Organizations running these affected versions are at risk of unauthorized code execution if their servers are accessible to unauthenticated users.

CERT-EU advises that all organizations should run an assessment to identify potentially compromised assets. The agency emphasizes that internet-facing assets require the highest priority for updates. This recommendation reflects the ease with which unauthenticated attackers can exploit the integer overflow flaw without needing prior access to the system.

What should you do?

Organizations should verify their current GitLab version against the affected list provided in the vendor’s advisory. If running an affected version, administrators should apply the patch immediately. Security teams should deploy the detection rules published by GitLab to monitor for exploitation attempts. Conducting a thorough assessment of internet-facing instances is crucial to determine if any systems have already been compromised.