Loading story…
Authorities warned of critical vulnerabilities in GitLab Community Edition and Enterprise Edition and the Apache Commons Text component that could be exploited remotely over a network. In both cases, the flaws were described as reachable without physical access, requiring no user interaction and no prior authentication, making internet-exposed systems particularly at risk.
The advisories indicate that attackers could target the vulnerable software directly rather than relying on phishing or stolen credentials, raising the likelihood of rapid opportunistic exploitation. Organizations using affected GitLab deployments or applications that include Apache Commons Text were urged to identify exposed assets quickly and prioritize remediation because the weaknesses could enable severe compromise through unauthenticated remote attacks.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Traficom published an alert about a critical vulnerability affecting GitLab Community Edition and Enterprise Edition. The synopsis states the issue was remotely exploitable without physical access, user interaction, or authentication.
Traficom published an alert about a critical vulnerability in the Apache Commons Text component. The synopsis indicates the flaw could be exploited remotely over a network without user interaction or authentication.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab patched **CVE-2026-85706**, a CVSS 10.0 vulnerability in the repository commits API that lets unauthenticated remote attackers bypass path restrictions and read arbitrary files from vulnerable self-managed GitLab CE and EE servers. CISA added the flaw to its Known Exploited Vulnerabilities catalog, while public proof-of-concept material, Nuclei templates, scanning, and attempted exploitation have increased the risk that exposed instances could leak secrets, CI/CD credentials, and deployment material. Organizations should urgently upgrade to GitLab versions **19.1.8**, **19.2.6**, or **19.3.2**, as applicable, and review API request logs for traversal attempts against commit endpoints. The releases also remediate critical flaws including **CVE-2026-87719**, an authenticated GitLab EE Duo Chat unsafe-deserialization issue, alongside other high-severity bugs that can enable remote code execution, configuration changes, CI/CD-variable access, denial of service, or GraphQL authorization and CSRF attacks; defenders should treat a GitLab compromise as a potential software supply-chain incident.
Sep 19, 2026
GitLab Community Edition (CE) and Enterprise Edition (EE) updates address seven vulnerabilities, including the critical path-traversal flaw **CVE-2026-85706** and two critical CI/CD code-execution vulnerabilities, **CVE-2026-89078** and **CVE-2026-93577**. CVE-2026-85706 has a CVSS score of 10.0 and allows an unauthenticated remote attacker to read arbitrary files through the repository commits API because of improper path confinement and missing authentication enforcement. FortiGuard reported exploitation attempts across multiple countries and sectors, while CISA added the flaw to its Known Exploited Vulnerabilities catalog. The two CVSS 9.9 CI/CD flaws can allow an authenticated user to execute arbitrary code on the GitLab server under certain conditions using specially crafted regular expressions in CI/CD configuration. Self-managed GitLab administrators should upgrade immediately: versions 19.2 should move to **19.2.7** or later, 19.3 to **19.3.3** or later, and 19.4 to **19.4.1** or later; earlier fixes for CVE-2026-85706 were released in 19.1.8, 19.2.6, and 19.3.2. Organizations should also review repository commits API logs for suspicious requests, particularly attempts to retrieve configuration or credential files.
Oct 1, 2026
German authorities issued multiple security advisories for **GitLab** and **Gitea**, warning of newly tracked vulnerabilities that affect widely used source code management and DevOps platforms. Two separate dCERT notices flagged **multiple vulnerabilities in GitLab**, indicating more than one security issue requiring administrator attention across the platform. A separate dCERT advisory warned that **Gitea** contains a vulnerability that can **bypass security measures**, raising concern that protections intended to restrict access or enforce policy may be circumvented. While the advisories did not publish technical synopses in the referenced notices, the alerts indicate that organizations using GitLab or Gitea should review vendor guidance, identify affected deployments, and prioritize patching or other mitigations.
Jun 29, 2026