More than 5,300 internet-exposed GitLab server instances are still vulnerable to a critical zero-click vulnerability. This flaw, tracked as CVE-2023-7028 (CVSS score of 10.0/10.0), is an account takeover vulnerability allowing attackers to redirect password reset emails to an attacker-controlled email address, enabling them to change the password and take over victim accounts that are not protected by two-factor authentication (2FA). The vulnerability affects various GitLab Community and Enterprise Edition versions, with patches released in updates on January 11, 2024. Despite these updates, researchers report that 5,379 vulnerable instances remain online, with the majority located in the United States, Germany, Russia, and China. These servers are at high risk of supply-chain attacks, code disclosure, and API key leaks. GitLab has provided detection tips and advises those who haven’t patched to first investigate for signs of compromise, rotate all credentials, enable 2FA, and inspect their development environments for any tampering. As of now, there are no confirmed in-the-wild exploitations of the vulnerability, but given the number of vulnerable instances, the risk remains significant. CTIX analysts recommend that all administrators responsible for these instances ensure that they have upgraded to the most recent software versions and analyze their own environments to ensure that there hasn’t already been a compromise.