Exploitation observed; activity peaked at 69 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-14. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-09-11 | 51 | Active Exploitation12Disclosure3Exploit2General1Patch27PoC6 |
| 2026-09-12 | 52 | Active Exploitation29Disclosure2Exploit1General1Patch17PoC2 |
| 2026-09-13 | 29 | Active Exploitation23Disclosure1General1Patch4 |
| 2026-09-14 | 69 | Active Exploitation52Disclosure3Exploit2General3Patch7PoC2 |
| 2026-09-15 | 31 | Active Exploitation23Disclosure4General1Patch3 |
| 2026-09-16 | 14 | Active Exploitation7Disclosure2General2Patch2PoC1 |
| 2026-09-17 | 5 | Active Exploitation3General1Patch1 |
| 2026-09-18 | 7 | Active Exploitation5Disclosure1Exploit1 |
| 2026-09-19 | 3 | Active Exploitation3 |
| 2026-09-20 | 2 | Active Exploitation1Patch1 |
| 2026-09-21 | 3 | Active Exploitation2Patch1 |
| 2026-09-22 | 2 | Active Exploitation1Patch1 |
| 2026-09-23 | 1 | Active Exploitation1 |
| 2026-09-24 | 3 | Active Exploitation1Disclosure2 |
| 2026-09-25 | 3 | Active Exploitation2Disclosure1 |
| 2026-09-26 | 1 | Active Exploitation1 |
| 2026-09-28 | 6 | Active Exploitation2Disclosure2Patch1PoC1 |
| 2026-09-29 | 4 | Active Exploitation1Disclosure1General1PoC1 |
| 2026-09-30 | 10 | Active Exploitation5Disclosure1Exploit1General1Patch1PoC1 |
| 2026-10-01 | 1 | Active Exploitation1 |
| 2026-10-02 | 5 | Active Exploitation1Disclosure1PoC3 |
| 2026-10-03 | 3 | Active Exploitation3 |
| 2026-10-04 | 2 | Active Exploitation1Disclosure1 |
| 2026-10-05 | 3 | Active Exploitation2Disclosure1 |
| 2026-10-06 | 1 | Patch1 |
| 2026-10-07 | 1 | Active Exploitation1 |
| 2026-10-08 | 2 | Disclosure2 |
| 2026-10-10 | 1 | Disclosure1 |
| 2026-10-12 | 1 | Patch1 |
| 2026-10-13 | 1 | General1 |
| 2026-10-19 | 2 | Active Exploitation1Patch1 |
| 2026-10-20 | 1 | Active Exploitation1 |
| 2026-10-22 | 1 | Active Exploitation1 |
CVE-2026-85706 Gitlab Path Traversal CVSS 10.0 👀👀 https://t.co/hQ0FOJ0UfH
Post summary
A new GitLab path traversal vulnerability (CVE-2026-85706) with a CVSS score of 10.0 is announced, but no PoC, exploit, patch, or active exploitation details are provided.
🚨 CVE-2026-85706 - GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read Nuclei Template: https://cloud.projectdiscovery.io/library/CVE-2026-85706 Reference: https://www.pruva.dev/reproductions/REPRO-2026-00354 #gitlab #cve #bugbounty #hackwithautomation https://t.co/nuxYtYKSbe
Post summary
The tweet announces CVE-2026-85706, an Arbitrary File Read vulnerability in GitLab CE/EE up to specified versions, and shares a Nuclei template link as a proof of concept. No evidence of active exploitation, functional exploit tools, patches, or debunking claims is present in the text.
🚨 GitLab CVSS 10 vulnerability exploited just one day after disclosure Threat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances. ⠀ The flaw allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server using a single HTTP request. Affected versions include: • GitLab 18.7 through versions before 19.1.8 • GitLab 19.2 through versions before 19.2.6 • GitLab 19.3 through versions before 19.3.2 ⠀ GitLab disclosed and patched the vulnerability on September 10. Just one day later, watchTowr began observing in-the-wild exploitation attempts and warns that mass exploitation is likely to follow. ⠀ Administrators should upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or a newer supported release. http://GitLab.com is already patched.
Post summary
CVE-2026-85706, a critical path traversal vulnerability in GitLab, is actively exploited just one day after disclosure, prompting immediate patching and upgrade recommendations.
🔴 GitLab CVE-2026-85706 için public PoC yayınlandı. CVSS 10.0 olarak değerlendirilen kritik açık, etkilenen GitLab CE/EE sürümlerinde kimlik doğrulaması olmadan sunucudaki yerel dosyaların okunmasına izin veriyor. Açık, GitLab Workhorse ile Rails/Puma arasındaki URL encoding/parsing uyuşmazlığının istismar edilmesiyle güvenlik kontrolünün aşılmasından kaynaklanıyor. 🔴 Etkilenen: 18.7–19.1.7 19.2.0–19.2.5 19.3.0–19.3.1 ✅ Güncellenmesi gereken: 19.1.8 / 19.2.6 / 19.3.2 Açığın şu an güncel saldırılarda istismar edildiği bildiriliyor. https://github.com/guneykabel/cve-2026-85706
Post summary
A public PoC for GitLab CVE‑2026‑85706 has been released, and the critical local‑file‑read vulnerability is reportedly being actively exploited; the vendor recommends updating to patched versions.
🚨 CVE-2026-85706: a CVSS 10.0 vulnerability in GitLab's repository commits API. Unauthenticated attackers can read arbitrary files, which may enable further impact. Example exploit below 👇 https://t.co/0ZGGco7SfB
Post summary
The post announces a CVSS 10.0 vulnerability in GitLab’s repository commits API (CVE-2026-85706) and points to a link with an example exploit, but it does not provide a patch, active exploitation evidence, or detailed exploit code.
‼️ GitLab’s CVSS 10 file-read flaw (CVE-2026-85706) drew in-the-wild probes within hours of disclosure. If an instance has at least one public project, unauthenticated attackers can read logs and config files containing credentials and secrets. Read: https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html
Post summary
GitLab’s CVE‑2026‑85706, a CVSS 10 file‑read flaw, attracted real‑world probing immediately after disclosure, allowing unauthenticated attackers to read logs and configuration files containing sensitive credentials.
🔍💻 When a critical vulnerability like CVE-2026-85706 (GitLab Unauthenticated Arbitrary File Read) drops, it's not just an alert for defenders—it’s a masterclass in application security. Learn how manipulating the file.path parameter in the Repository Commits API triggers a path traversal flaw, and (BLUE TEAM) discover why validating data exfiltration from this exploit requires cross-referencing specific access logs. Read the full technical breakdown here: 🔗 https://bit.ly/4yqqKOe #VulnerabilityResearch #CVE #OffSec #AppSec #CyberSecurity #InfoSec
Post summary
The tweet announces CVE-2026-85706 as a critical GitLab arbitrary file read vulnerability, describes the path traversal mechanism, and links to a detailed analysis, but does not include PoC code, exploit tools, patches, or reports of active exploitation.
🚨 CVE-2026-85706: An unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1 PoC: https://github.com/guneykabel/cve-2026-85706
Post summary
CVE‑2026‑85706 is an unauthenticated arbitrary file read vulnerability in GitLab CE‑EE, affecting multiple 18.x and 19.x releases, with a publicly available PoC; no active exploitation or patch information is reported.
Update: CISA has confirmed active exploitation of GitLab CVE-2026-85706 and added it to the KEV catalog. U.S. federal civilian agencies must apply fixes by Sept. 14, 2026.
Post summary
CISA confirms active exploitation of GitLab CVE-2026-85706, adding it to the KEV catalog and urging federal agencies to patch by September 14, 2026.
🛡️ CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks Details: https://cybersecuritynews.com/cisa-gitlab-path-traversal/ CISA has added a critical GitLab vulnerability, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog, warning that attackers are actively exploiting the flaw. The issue affects GitLab Community Edition and Enterprise Edition deployments and carries a maximum CVSS severity score of 10.0. CVE-2026-85706 is a path traversal vulnerability in GitLab’s repository commits API. #cybersecuritynews
Post summary
CISA reports that CVE-2026-85706, a critical path‑traversal flaw in GitLab’s repository commits API, is currently being exploited in the wild.
🚨 CRITICAL GITLAB FLAW IS BEING ACTIVELY EXPLOITED — NO AUTHENTICATION REQUIRED A maximum-severity GitLab vulnerability tracked as CVE-2026-85706 is now being actively exploited in the wild. The flaw affects self-managed GitLab CE/EE and can allow an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server through the repository commits API. * CVSS score: 10.0 * No authentication required * No user interaction required * Successful exploitation can expose configuration files, source-code-related secrets, credentials, tokens and private keys * CISA has added the flaw to its Known Exploited Vulnerabilities catalog * GitLab released patched versions 19.1.8, 19.2.6 and 19.3.2 ⚠️ Analyst Note: GitLab servers frequently sit at the center of development and CI/CD environments. File disclosure here can become much more than a data leak if attackers obtain deployment credentials, cloud tokens or pipeline secrets that enable follow-on supply-chain compromise. Organizations running self-managed GitLab should patch immediately and investigate potentially exposed credentials. Original GitLab advisory: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ #GitLab #CVE #CyberSecurity #SupplyChain #ThreatIntel #DDW
Post summary
CVE-2026-85706 is a maximum-severity GitLab vulnerability (CVSS 10.0) being actively exploited in the wild for unauthenticated arbitrary file read; patches are available (19.1.8/19.2.6/19.3.2) and CISA has listed it in its KEV catalog.
🚨 Detection for the actively exploited GitLab vulnerability tagged as CVE-2026-85706 (CVSS 10.0) available here: https://github.com/projectdiscovery/nuclei-templates/pull/17231/changes https://t.co/Xwiea4sxsd
Post summary
A detection template for CVE-2026-85706, an actively exploited GitLab vulnerability with CVSS 10.0, is posted; no exploit code or patch is provided.
🚨 CRITICAL ZERO-DAY: GitLab Path Traversal (CVE-2026-85706 | CVSS 10.0) Active mass exploitation detected in the wild. Added to CISA KEV. Impact: Unauthenticated arbitrary file read (SSH keys, runner secrets, configs) • Scope: GitLab CE/EE 18.7–19.3.1 (public projects) • IoCs: Unusual POST traffic to /api/v4/projects/{id}/repository/commits/ targeting file_path with ../ or %2e%2e%2f Patch immediately and review your reverse proxy / Nginx logs. #CyberSecurity #InfoSec #GitLab #ZeroDay #ThreatIntel
Post summary
The tweet reports a critical GitLab path traversal zero‑day (CVE‑2026‑85706) with active mass exploitation and CISA KEV inclusion, urging immediate patching and log review.
GitLab CE/EE is affected by CVE-2026-85706 (CVSS 10.0 - Critical), an unauthenticated arbitrary file read flaw in the repository commits API. Upgrade to 19.1.8, 19.2.6, or 19.3.2. Read more: https://ow.ly/QkGf50ZPNXE https://t.co/HkW8lPButp
Post summary
The post identifies CVE-2026-85706 as a critical arbitrary file read vulnerability in GitLab and recommends upgrading to versions 19.1.8, 19.2.6, or 19.3.2.
GitLab pide a sus usuarios corregir una vulnerabilidad crítica de salto de directorio GitLab ha instado a sus usuarios a actualizar sus servidores inmediatamente para corregir dos vulnerabilidades críticas: una de salto de directorio (CVE-2026-85706) que permite leer archivos arbitrarios y otra de deserialización insegura (CVE-2026-87719) https://blog.elhacker.net/2026/09/gitlab-pide-sus-usuarios-corregir-una.html
Post summary
The text focuses on GitLab urging immediate server updates to fix two critical vulnerabilities: directory traversal with arbitrary file read and insecure deserialization. It provides technical vulnerability details but does not mention PoC, exploit code, or active exploitation.
watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request. As usual, indiscriminate exploitation is unlikely to be far away. https://t.co/oJGDRFNty1
Post summary
The post reports that GitLab CVE‑2026‑85706, which permits reading arbitrary files, is already being probed in the wild, signalling imminent active exploitation.
CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild
Post summary
The tweet reports that CVE‑2026‑85706, a critical GitLab path traversal vulnerability, has been observed being actively exploited in the wild.
يا ربِّ لَكَ الحمدُ كما ينبَغي لجلالِ وجهِكَ ولعَظيمِ سُلطانِكَ Really happy to share that one of my recent security research findings has been assigned CVE-2026-85706 and rated CVSS 10.0 Critical by @gitlab. The vulnerability affects GitLab CE/EE and could allow an unauthenticated attacker to read arbitrary files from the GitLab server. GitLab has now released the patches. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ Seeing the vulnerability getting attention from security researchers, threat intelligence teams, cybersecurity publications, and even official security advisories around the world has been a very rewarding moment. Huge thanks to the GitLab Security team & HackerOne for handling the report and remediation. CVE-2026-85706 | GitLab | CVSS 10.0 @Hacker0x01 #CyberSecurity #BugBounty #GitLab #CVE #SecurityResearch #HackerOne #InfoSec
Post summary
The tweet announces a critical CVE-2026-85706 for GitLab, describes the unauthenticated file‑read vulnerability, and informs that a patch has been released.
GitLab security team waking up every few weeks: “yeah… another critical one.” CVE-2026-85706 is CVSS 10.0. Unauthenticated path traversal → arbitrary file read via the repository commits API. Self-hosted GitLab admins: please patch your shit. 💀 https://t.co/SXlpmHL7Pr
Post summary
GitLab warns of the critical CVE‑2026‑85706, an unauthenticated path traversal flaw with CVSS 10.0, and urges self‑hosted admins to apply patches immediately.
CISA تُدرج CVE-2026-85706 في كتالوج KEV: ثغرة اجتياز مسار في واجهة commits لـ GitLab CE/EE بدرجة CVSS 10، تسمح بقراءة ملفات دون مصادقة في ظروف معيّنة. المهلة حتى 14 سبتمبر. رقّع المثيلات الذاتية الإدارة إلى 19.1.8 أو 19.2.6 أو 19.3.2، وراجع سجلات طلبات commits المشبوهة. CISA #سيبراني #GitLab #KEV
Post summary
CISA lists CVE‑2026‑85706 as a high‑severity path traversal in GitLab’s commits interface and advises users to upgrade to specific releases by 14 Sep.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gitlab | gitlab | - | - | - |
| App | gitlab | gitlab | - | - | - |