CISA Mandates Urgent Patching for Exploited GitLab Critical Flaw

Key points

• CISA added CVE-2026-85706 to the KEV catalog, triggering a three-day patch deadline for federal agencies under BOD 26-04.
• The vulnerability is a path traversal flaw in the repository commits API with a CVSS score of 10.0, allowing unauthenticated file reads.
• watchTowr reported active in-the-wild probes starting September 11, 2026, warning that indiscriminate exploitation is likely soon.
• GitLab patched the issue in Community and Enterprise Editions 19.3.2, 19.2.6, and 19.1.8, affecting versions from 18.7 onward.
• A second critical flaw, CVE-2026-87719, was also patched, allowing authenticated users to bypass serialization and access sensitive configurations.

Background

This incident follows a pattern of rapid exploitation of critical software flaws, similar to recent ransomware campaigns targeting SharePoint and Citrix NetScaler vulnerabilities. GitLab has faced multiple actively exploited vulnerabilities since 2021, including a high-severity two-factor authentication bypass in January 2026. The platform is widely used, with over 30 million registered users and adoption by more than 50% of Fortune 100 companies, making it a high-value target for attackers seeking source code and CI/CD secrets.

How outlets are covering it

BleepingComputer and CyberScoop emphasize the official government response, highlighting CISA’s addition of the flaw to the KEV list and the binding directive for federal agencies. The Hacker News provides deeper technical context, noting that the vulnerability is the second critical GitLab issue in recent weeks, following a GraphQL code injection flaw. watchTowr, cited across all sources, stresses the urgency, stating that probes were observed within hours of disclosure and that defenders should monitor logs for specific POST requests to identify exploitation attempts. All sources agree on the immediate need for patching, but The Hacker News uniquely highlights the risk of build pipeline poisoning, while CyberScoop notes that GitLab’s hosted service is already patched and unaffected.

Why it matters

The rapid transition from disclosure to active exploitation underscores the critical risk posed by internet-facing development platforms. With GitLab’s widespread adoption in enterprise environments, unpatched instances expose sensitive credentials, source code, and CI/CD pipelines to unauthorized access. The CISA directive signals a broader trend of federal agencies prioritizing rapid remediation of known exploited vulnerabilities, setting a precedent for private sector organizations to follow similar risk-based management practices to avoid similar breaches.

What to watch

Federal agencies must complete patching within three days of the CISA directive. Private sector organizations are encouraged to apply the same urgency, upgrading to patched versions or restricting internet access to self-hosted GitLab instances. Defenders should monitor logs for suspicious POST requests to the repository commits API to identify potential exploitation attempts. GitLab will likely continue to monitor for further exploitation and may issue additional advisories if new attack vectors emerge.