SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
4 SOURCES ON THIS EVENT
◆ WATCHCVE-2026-110264 · CVSS 10.0

GitLab: attackers can run their own code

AFFECTSGitLab

OFFICIAL NAME: Integer Overflow or Wraparound in GitLab

WHAT IT IS · DEVELOPER TOOLSIt holds source code and the keys used to build and ship software.

DO THIS FIRSTPatch it. If it faced the internet, change the keys and passwords stored in it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted…

WHY THIS VERDICT One source reports attacks and the vulnerability is 20 days old. In our backtest a single early report was confirmed within 30 days about one time in twenty, so we wait for a second report or for attack attempts to be seen.

WHY IT RANKS HERE Exploitation is reported. The first report is 9 days old.

HIGHEST CONFIRMED RUNG
TALK
CISA KEV
NOT YET
EXPLOIT CODE
PROOF OF CONCEPT CLAIMED
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    CVE-2026-110264 discussed publicly (CIRCL sighting). Max-severity GitLab bug allows remote code execution over 12 years of releases.

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    Attacks that worked are reported (step 4), so attempts count as reported too.

  4. 04 EXPLOITED

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    Exploitation of CVE-2026-110264 reported (CIRCL sighting).

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-110264 published
  2. EXPLOIT CODE PUBLIC
    CLAIMED
  3. FIRST ATTACK REPORT
    CIRCL Vulnerability-Lookup sightings
  4. CISA KEV LISTING
    NOT YET
  5. US FEDERAL DEADLINE
    NOT YET
Attacks were reported 11 days after disclosure.
// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. OCT 22, 2026
    11 public GitHub repositories claim a proof of concept for CVE-2026-110264
  2. OCT 22, 2026
    Max-severity GitLab bug allows remote code execution over 12 years of releases
  3. Attack activity. NOV 2, 2026
    Exploitation of CVE-2026-110264 reported (CIRCL sighting)
  4. NOV 5, 2026
    CVE-2026-110264 discussed publicly (CIRCL sighting)

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-110264 discussed publicly (CIRCL sighting), NOV 5
  2. [2] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-110264 reported (CIRCL sighting), NOV 2
  3. [3] The Register (security): Max-severity GitLab bug allows remote code execution over 12 years of releases, OCT 22
  4. [4] PoC-in-GitHub: 11 public GitHub repositories claim a proof of concept for CVE-2026-110264, OCT 22