Over 8,300 Gitea servers vulnerable to code execution attacks
Over 8,300 Gitea servers remain unpatched against a critical code execution vulnerability.
Run Salesforce?
Get an email when a reviewed story names Salesforce, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Over 8,300 internet-exposed Gitea instances are still vulnerable to remote code execution attacks due to an unpatched critical security flaw (CVE-2026-60004). The vulnerability allows authenticated attackers to execute arbitrary shell commands, and with default open registration, unauthenticated attackers can exploit it by creating an account and a repository. Attackers are reportedly deploying cryptocurrency mining malware on compromised servers.
The lesson from this incident
Full lessonOver 8,300 internet-facing Gitea servers remain unpatched against CVE-2026-60004, a critical remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell commands. The risk is compounded by Gitea's default open registration setting, which effectively removes the 'authenticated' barrier and allows anyone on the internet to exploit the flaw without prior credentials. This combination of a delayed patching posture and a permissive default configuration is enabling active cryptomining campaigns against compromised servers. The incident underscores that exposing unpatched, publicly reachable developer infrastructure is a high-risk practice, as code repositories often hold sensitive secrets, source code, and pipeline credentials that can cascade into broader supply chain compromises.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-60004
- cve — CVE-2026-20896
- malware — cryptocurrency mining malware