Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

Attackers Exploit Critical GitLab Flaw Within a Day of Patches

Part of the CVE-2026-85706 story · since 11 Sep

Quiet for 2 weekslast report 13 Oct12 articles8 outlets
11 Sep · SecurityOnline first5 Oct13 OctNowThis article2nd of 12
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical GitLab Flaw Within a Day of Patches. Cites a CVE in CISA KEV. This article, 2nd of 12.
  • Fri 11 Sep, 17:37 UTC. The Hacker News, its first report on the story. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:33 UTC. CISA, its first report on the story. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 12:47 UTC. Security Affairs, its first report on the story. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 10:11 UTC. Infosecurity, its first report on the story. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 11:57 UTC. Rapid7, its first report on the story. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 21:05 UTC. Dark Reading, its first report on the story. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.

SecurityWeek reports that a critical path traversal vulnerability in GitLab, tracked as CVE-2026-85706 with a CVSS score of 10/10, was exploited in the wild barely a day after GitLab disclosed patches. The flaw allows unauthenticated attackers to read arbitrary files from the GitLab server via a single HTTP request. The issue affects all Community Edition (CE) and Enterprise Edition (EE) releases from 18.7 prior to 19.1.8, 19.2 prior to 19.2.6, and 19.3 prior to 19.3.2.

WatchTowr Intel reported observing in-the-wild exploitation attempts shortly after the patch release, indicating attackers were actively scanning for and attempting to exploit the vulnerability.

The GitLab patches also address CVE-2026-87719, an insecure deserialization flaw in the GraphQL subscription serializer with a CVSS of 9.9/10, which could expose advanced search instance configurations and sensitive credentials. The fixed CE/EE versions for this flaw are 19.1.8, 19.2.6 and 19.3.2, and the updates additionally resolve six high-severity defects that could enable remote code execution, access to protected CI/CD variables, cross-site scripting, and denial-of-service conditions.

Defenders are advised to upgrade promptly and to watch logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ containing file[.]path parameters, which WatchTowr described as indicative of exploitation attempts.

How the story developed

All 12 articles
Quiet for 2 weekslast report 13 Oct12 articles8 outlets

12 articles from 8 outlets since 11 Sep. Quiet since 13 Oct. This was the 2nd report, 15 hours after the first.

Now11 Sep1213141512 Oct13First reportSecurityOnline · 11 Sep, 01:30This article2nd of 12 · day 0
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical GitLab Flaw Within a Day of Patches. Cites a CVE in CISA KEV. This article, 2nd of 12.
  • Fri 11 Sep, 17:37 UTC. The Hacker News, its first report on the story. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:33 UTC. CISA, its first report on the story. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 12:47 UTC. Security Affairs, its first report on the story. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 10:11 UTC. Infosecurity, its first report on the story. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 11:57 UTC. Rapid7, its first report on the story. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 21:05 UTC. Dark Reading, its first report on the story. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 12 articles as a list
  1. Fri 11 SepDay 04
    1. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files01:30 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Attackers Exploit Critical GitLab Flaw Within a Day of Patches16:30 · SecurityWeek · Known exploited CVE · This article, 2nd of 12
    3. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets17:37 · The Hacker News · Known exploited CVE
    4. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files20:33 · CISA · official · CISA alert · Known exploited CVE

  2. Quiet for 2 days

    Sun 13 SepDay 21
    1. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers12:47 · Security Affairs · Known exploited CVE
  3. Mon 14 SepDay 35
    1. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws03:11 · SecurityOnline · Known exploited CVE
    2. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw10:11 · Infosecurity · Known exploited CVE
    3. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching11:57 · Rapid7 · Known exploited CVE
    Show 2 more from 14 Sep
    1. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited15:26 · Security Affairs · Known exploited CVE
    2. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw21:05 · Dark Reading · Known exploited CVE

  4. Quiet for 4 weeks

    Mon 12 OctDay 311
    1. Actively Exploited Vulnerabilities Jump to 100 in Q3 202604:01 · SecurityOnline · Picked up again · Known exploited CVE
  5. Tue 13 OctDay 321
    1. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code09:12 · The Hacker News · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in