Notable Critical CVEs in Late 2026: GitLab, Citrix, and Others
Several additional critical vulnerabilities were disclosed or added to the CISA Known Exploited Vulnerabilities catalog in late 2026. The following is a short awareness summary of items that may affect common enterprise environments.
GitLab CE/EE (CVE-2026-97229)
An integer overflow in the CI/CD regular expression compiler allowed unauthenticated remote code execution on self-managed GitLab instances (versions 19.2 through 19.4). CVSS 10.0. Patched versions were released; self-managed instances should be upgraded promptly.
Citrix / NetScaler
Multiple NetScaler ADC and Gateway issues were added to the KEV catalog through 2026, including memory-related and other high-severity flaws. Organizations running internet-facing NetScaler appliances should verify they are on current patched releases and review for signs of compromise if they were exposed during active exploitation windows.
Fortinet and Ivanti (additional)
Beyond the items covered in earlier posts, Fortinet and Ivanti released patches for additional critical issues in products including FortiSIEM, FortiSandbox, and Endpoint Manager during late 2026. Organizations using these products should review vendor advisories for their specific versions.
These summaries are for awareness only and do not include exploit details. Always consult the vendor advisory and CISA KEV list for the latest status.