Skip to content
OriginalSign in
Image: Rapid7

Rapid7Rapid7

Critical GitLab Flaw Exploited as CISA Orders Emergency Patching

Part of the CVE-2026-85706 story · since 11 Sep

Quiet for 2 weekslast report 13 Oct12 articles8 outlets
11 Sep · SecurityOnline first8 Oct17 OctNowThis article8th of 12
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical GitLab Flaw Within a Day of Patches. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 17:37 UTC. The Hacker News, its first report on the story. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:33 UTC. CISA, its first report on the story. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 12:47 UTC. Security Affairs, its first report on the story. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 10:11 UTC. Infosecurity, its first report on the story. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 11:57 UTC. Rapid7, its first report on the story. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching. Cites a CVE in CISA KEV. This article, 8th of 12.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 21:05 UTC. Dark Reading, its first report on the story. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.

Rapid7 reported on 14 September 2026 that a critical GitLab vulnerability, CVE-2026-85706, was being exploited in the wild. GitLab disclosed and patched the path-traversal flaw in its repository commits API on 10 September. Rated CVSS 10.0, the vulnerability could, under certain conditions, allow an unauthenticated attacker to read arbitrary files from an affected server because of inadequate path confinement and missing authentication enforcement.

The issue affects self-managed GitLab Community Edition and Enterprise Edition installations across Omnibus, source-code and Helm chart deployments. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 11 September, citing evidence of active exploitation, and set a 14 September remediation deadline for affected US federal civilian agencies, alongside forensic triage requirements. Rapid7 said CVE-2026-85706 was the only vulnerability in the release known to be exploited at the time of publication.

GitLab’s fixed versions are 19.1.8, 19.2.6 and 19.3.2, covering versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 respectively. GitLab.com is already patched, while GitLab Dedicated customers do not need to act. The updates include database migrations: single-node installations will experience downtime, while multi-node deployments can use GitLab’s zero-downtime procedure; only version 19.3.2 includes post-deployment migrations.

Rapid7 recommends emergency patching and checking for signs of compromise even after updating. It also noted that the release fixes 17 other vulnerabilities, including CVE-2026-87719, but said that flaw was not known to be exploited.

How the story developed

All 12 articles
Quiet for 2 weekslast report 13 Oct12 articles8 outlets

12 articles from 8 outlets since 11 Sep. Quiet since 13 Oct. This was the 8th report, 3 days after the first.

Now11 Sep1213141512 Oct13First reportSecurityOnline · 11 Sep, 01:30This article8th of 12 · day 3
  • Fri 11 Sep, 01:30 UTC. SecurityOnline, first report. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 16:30 UTC. SecurityWeek, its first report on the story. Attackers Exploit Critical GitLab Flaw Within a Day of Patches. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 17:37 UTC. The Hacker News, its first report on the story. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 20:33 UTC. CISA, its first report on the story. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files. Cites a CVE in CISA KEV.
  • Sun 13 Sep, 12:47 UTC. Security Affairs, its first report on the story. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 10:11 UTC. Infosecurity, its first report on the story. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 11:57 UTC. Rapid7, its first report on the story. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching. Cites a CVE in CISA KEV. This article, 8th of 12.
  • Mon 14 Sep, 15:26 UTC. Security Affairs. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 21:05 UTC. Dark Reading, its first report on the story. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 04:01 UTC. SecurityOnline. Actively Exploited Vulnerabilities Jump to 100 in Q3 2026. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 09:12 UTC. The Hacker News. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 12 articles as a list
  1. Fri 11 SepDay 04
    1. GitLab Fixes Critical Path Traversal Flaw Exposing Server Files01:30 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Attackers Exploit Critical GitLab Flaw Within a Day of Patches16:30 · SecurityWeek · Known exploited CVE
    3. GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets17:37 · The Hacker News · Known exploited CVE
    4. CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files20:33 · CISA · official · CISA alert · Known exploited CVE

  2. Quiet for 2 days

    Sun 13 SepDay 21
    1. GitLab Zero Day Lets Attackers Steal Secrets From Public Servers12:47 · Security Affairs · Known exploited CVE
  3. Mon 14 SepDay 35
    1. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws03:11 · SecurityOnline · Known exploited CVE
    2. GitLab Urges Patching as Attackers Probe Critical File-Read Flaw10:11 · Infosecurity · Known exploited CVE
    3. Critical GitLab Flaw Exploited as CISA Orders Emergency Patching11:57 · Rapid7 · Known exploited CVE · This article, 8th of 12
    Show 2 more from 14 Sep
    1. CISA Flags Artifactory, ScreenConnect and GitLab Flaws as Exploited15:26 · Security Affairs · Known exploited CVE
    2. CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw21:05 · Dark Reading · Known exploited CVE

  4. Quiet for 4 weeks

    Mon 12 OctDay 311
    1. Actively Exploited Vulnerabilities Jump to 100 in Q3 202604:01 · SecurityOnline · Picked up again · Known exploited CVE
  5. Tue 13 OctDay 321
    1. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code09:12 · The Hacker News · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in