CISA: Hackers now exploit max severity GitLab flaw in attacks

Summary

CISA has issued a warning that a critical GitLab vulnerability (CVE-2026-85706) is being actively exploited by attackers. The flaw allows unauthenticated users to read sensitive information from vulnerable servers. GitLab has released patches, and CISA has added it to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by Friday under Binding Operational Directive 26-04.

Full text

CISA: Hackers now exploit max severity GitLab flaw in attacks By Sergiu Gatlan September 14, 2026 03:06 AM 0 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in attacks. GitLab's DevSecOps platform is used by over 50% of Fortune 100 companies and has over 30 million registered users worldwide. The security flaw (tracked as CVE-2026-85706) stems from missing authentication enforcement and improper path confinement in the repository commits API, and unauthenticated attackers can exploit it to read credentials, secrets, and other sensitive information from vulnerable servers. GitLab fixed this security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.3.2, 19.2.6, and 19.1 on Thursday, and urged users to patch their systems immediately. While the company has yet to tag this vulnerability as actively exploited, cybersecurity firm watchTowr reported one day later that attackers were probing the Internet for GitLab servers unpatched against CVE-2026-85706. "watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request," it warned. "Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away. [..] Defenders should also hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to identify potential exploitation attempts." That same day, CISA added the vulnerability to its catalog of actively exploited flaws, giving government agencies three days to secure their systems under Binding Operational Directive (BOD) 26-04. Although BOD 26-04 targets only federal agencies, CISA encouraged all network defenders, including those in the private sector, to patch their devices as soon as possible against ongoing attacks. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," it said. "While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities." In January, GitLab also patched a high-severity two-factor authentication bypass flaw that enables attackers who know the target's account ID to circumvent two-factor authentication. Since November 2021, CISA has tagged four GitLab vulnerabilities as actively exploited, including two (CVE-2021-22175 and CVE-2021-39935) in February this year. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: GitLab urges users to patch max severity path traversal flawCISA: WatchGuard RCE flaw now exploited in ransomware attacksCISA orders feds to patch Citrix NetScaler RCE flaw by SaturdayHackers now exploit critical Gitea flaw in code injection attacksCISA orders urgent patching of actively exploited Zimbra flaw

Indicators of Compromise

• cve — CVE-2026-85706

Entities