CVE Tools
Track your stack

CISA: Hackers now exploit max severity GitLab flaw in attacks

BleepingComputerBy Sergiu Gatlan

Reported exploitedGitLab CEGitLab EE

Our summary

CISA has designated CVE-2026-85706, a critical path traversal vulnerability in GitLab Community Edition and Enterprise Edition, as actively exploited in the wild. The flaw allows unauthenticated attackers to access sensitive data such as credentials and secrets via the repository commits API by bypassing proper path confinement. Fixed versions have been released for 19.3.2, 19.2.6, and 19.1, prompting immediate remediation recommendations for both government and private sector users.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerGitLab urges users to patch max severity path traversal flawCVE-2021-22175, CVE-2021-39935 +1
  2. Dark ReadingMaximum Severity GitLab Flaw Puts Supply Chains at RiskCVE-2026-85706
  3. The Hacker News⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and RootkitsCVE-2026-85706
  4. Check Point Research14th September – Threat Intelligence ReportCVE-2026-85706
  5. Хакер (xakep.ru)Разработчики призвали срочно исправить критическую уязвимость в GitLabCVE-2026-85706
  6. The Hacker NewsGitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After DisclosureCVE-2026-85706
  7. SecurityWeekGitLab Vulnerability Exploited One Day After DisclosureCVE-2026-85706

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store