Loading story…
CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog after confirming exploitation of a code-injection flaw in the Gitea self-hosted development platform. An attacker with repository write access can send a malicious patch to the diffpatch API, install an executable Git hook, and run shell commands under the Gitea service account. Gitea addressed the vulnerability in version 1.27.1; CISA set an August 28 remediation deadline for U.S. federal agencies and advised affected organizations to apply vendor mitigations, assess internet exposure, and conduct relevant forensic triage. The responsible threat actors and their objectives remain unknown.
CISA's preceding catalog update also added CVE-2026-21962, an improper access-control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. The Oracle flaw can permit unauthorized creation, deletion, modification, or access to critical data, potentially extending to all accessible product data. Organizations should prioritize patching or applying vendor mitigations for both KEV-listed vulnerabilities, and discontinue affected products where mitigations are unavailable.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
Shadowserver reported that 8,393 Internet-exposed Gitea IP addresses remained vulnerable to CVE-2026-60004. It also stated that exploitation attacks against the flaw were ongoing.
CISA added CVE-2026-60004 to the KEV Catalog, identifying known exploitation of the Gitea code-injection vulnerability. The flaw requires repository write access and can be exploited through the diffpatch API to install an executable Git hook and run shell commands under the Gitea service account.
CISA added CVE-2026-21962, an improper access control flaw affecting Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities Catalog. The flaw can enable unauthorized access to or modification of critical data, including complete access to accessible product data.
Independent security researchers published a working exploit tool for CVE-2026-60004. The tool operationalized exploitation of the Gitea diffpatch code-injection flaw to execute commands as the Gitea service account.
Gitea issued its formal security advisory for CVE-2026-60004, following the release of version 1.27.1 that fixed the critical diffpatch remote code-execution flaw.
Gitea released version 1.27.1, patching CVE-2026-60004, a vulnerability that can let a repository writer install a malicious Git hook and execute commands as the Gitea service account.
Organizations were warned that the separate Gitea vulnerability CVE-2026-20896 was being exploited in the wild. It had not been added to CISA's KEV Catalog at the time of the report.
Developer Andrey (@Causelof) reported that an unknown actor exploited CVE-2026-60004 against their HTTPS-exposed Gitea instance, deploying a miner-like dropper and causing sustained CPU utilization above 70%. The next-stage payload, mining pool, wallet, and operator were not identified.
A public proof of concept described exploitation of Gitea's diffpatch API by using a crafted patch to place a malicious Git hook in a temporary repository. Later Git operations can execute the hook as the Gitea service account, requiring an authenticated account with repository write access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
21 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcetriskelelabs.com
Open sourcecybersecuritynews.com
Open sourceboho.or.kr
Open sourcegithub.com
Open sourceblog.gitea.com
Open sourcedocs.docker.com
Open sourcecyber.dhs.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026
Gitea disclosed two severe vulnerabilities affecting repository automation and artifact handling. **CVE-2026-58424** is a remotely exploitable authorization flaw with a CVSS score of **8.9** that can bypass permanent fork pull-request workflow approval gates, undermining branch protection and merge controls. The issue is tied to permission weaknesses including `CWE-285`, `CWE-732`, and `CWE-863`, and fixes are referenced in Gitea releases **1.26.3** and **1.26.4**. Administrators are advised to harden pull-request workflow approvals, enforce strict branch protections, and review workflow logs for signs of bypass attempts. Gitea also addressed **CVE-2026-58426**, a critical signed-URL validation flaw in **Gitea Actions Artifacts V4** with a CVSS score of **9.6**. The `CWE-347` weakness stems from HMAC ambiguity and can allow cross-repository artifact reads and cross-task upload-state writes, creating a path for unauthorized access to build artifacts and tampering with task state. The recommended response is to upgrade to a fixed Gitea release, cited as **1.26.2**, and audit artifact access controls and upload-state integrity. Separately, Canada’s Centre for Cyber Security issued an advisory urging OpenSSH users to upgrade versions prior to **10.4**, but that notice appears unrelated to the Gitea flaws.
Jul 7, 2026
CISA expanded its Known Exploited Vulnerabilities catalog in a series of June updates, adding four newly exploited issues across enterprise and software platforms. The agency first listed **CVE-2026-45247** in Mirasvit Full Page Cache Warmer, a deserialization flaw that can enable unauthenticated remote code execution through a crafted serialized PHP object in the `CacheWarmer` cookie. It then added **CVE-2026-42271** in BerriAI LiteLLM, a command injection bug that can let any authenticated user, including low-privilege internal-user key holders, execute arbitrary commands on the host. CISA directed organizations to apply vendor mitigations, follow **BOD 22-01** guidance for cloud services, or discontinue use if mitigations are unavailable. CISA later added three more exploited vulnerabilities: a **Google Chromium V8** out-of-bounds read/write flaw that could allow sandboxed remote code execution via a crafted HTML page, an **Arista EOS** packet decapsulation vulnerability, and a **Cisco Catalyst SD-WAN Manager** flaw that could allow an authenticated local attacker to execute arbitrary commands as root. The KEV catalog count rose from **1,610** to **1,617** across the updates, and CISA assigned remediation deadlines ranging from **2026-06-06** to **2026-06-23**. Separate GitHub commits also showed Rack maintainers fixing multipart parsing denial-of-service issues tracked as **CVE-2025-61770**, **CVE-2025-61771**, and **CVE-2025-61772**, but those fixes were not part of the KEV additions described in the June catalog changes.
Jun 29, 2026