CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 (CVSS 10.0) to its KEV catalog, setting a September 14 federal patch deadline.
CISA added CVE-2026-85706, a CVSS 10.0 path traversal vulnerability in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog on September 11, 2026. The flaw affects GitLab CE/EE versions 18.7-19.1.7, 19.2-19.2.5, and 19.3-19.3.1, allowing unauthenticated attackers to read arbitrary files from affected servers without user interaction. Fixes are available in GitLab 19.1.8, 19.2.6, and 19.3.2, and federal civilian agencies must remediate by September 14, 2026 under Binding Operational Directive 26-04. GitLab credited researcher s3ntago via HackerOne; arbitrary file disclosure could expose credentials, tokens, and CI/CD secrets useful for follow-on intrusions.
GitLab urges self-managed users to immediately patch a maximum-severity path traversal flaw (CVE-2023-2825) enabling unauthenticated arbitrary file reads.
GitLab released patches in CE/EE versions 19.3.2, 19.2.6, and 19.1 for CVE-2023-2825, a maximum-severity path traversal vulnerability that lets unauthenticated attackers read arbitrary files from vulnerable servers under certain conditions. The flaw, reported by researcher s3ntago via HackerOne, stems from improper path confinement and missing authentication enforcement in the repository commits API. GitLab also patched CVE-2026-87719, an insecure deserialization flaw in the GraphQL subscription serializer affecting Enterprise Edition users with Duo Chat access, which could expose credentials and Advanced Search configurations. GitLab.com and Dedicated customers are already protected; the platform has over 30 million registered users and is used by more than 50% of Fortune 100 companies.
Contrast Security report finds 42 confirmed exploit attempts per application monthly and three AI scanners agreeing on only 5% of findings.
Contrast Security's AppSec Overflow 2026 report, drawing on telemetry from hundreds of thousands of production applications and APIs, found adversaries touch the average application every four minutes with 42 confirmed viable exploit attempts per application monthly, led by untrusted deserialization, path traversal, and method tampering. Legacy flaws Log4Shell and Spring4Shell remain widespread, mean time to exploit fell from over two years in 2018 to under three weeks for most 2025 exploited vulnerabilities, and average critical fix time is 92 days. Three AI scanners set on the same codebase agreed on only 5% of findings, and triaging a 2-million-line codebase scan cost roughly $128,000 versus $315 in API charges. Among exploited CVEs in the dataset, 82% of KEV-listed entries carried EPSS scores of 90% or higher, while CVE-2006-1547 and CVE-2023-38180 were confirmed exploited despite EPSS scores under 25%.
Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE
CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed.
Unauthenticated SSRF in GitLab via Internal-Network Webhook Requests (CVE-2021-22175)
CVE-2021-22175 is a server-side request forgery (SSRF, CWE-918) in GitLab's webhook handling that affects all GitLab versions starting from 10.5. It is exploitable when the administrator setting that allows webhook and integration requests to the internal network is enabled, and an unauthenticated attacker can leverage it even on instances where self-registration is disabled, so no account or credentials are required. A successful attack makes the GitLab server issue requests to internal-network destinations, letting the attacker probe or interact with internal-only services reachable from the GitLab host (for example cloud metadata endpoints or internal APIs); the flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact. Self-managed GitLab deployments running an affected version with internal-network outbound requests enabled are the exposed population, while instances that are not internet-reachable or that keep that setting disabled are not reachable by this unauthenticated attack path. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-02-18, confirming in-the-wild exploitation; EPSS assigns a 53.4% probability of exploitation within 30 days (99th percentile), and related reporting describes coordinated SSRF exploitation involving more than 400 source IPs.
· GitLab (self-managed Community and Enterprise editions) all versions starting from 10.5 until the vendor fix; fixed in 13.7.1, with backports in 13.6.2 and 13.5.4 (per GitLab's security advisory) KEV PoC large
Unauthenticated DoS in Microsoft .NET, ASP.NET Core and Visual Studio 2022
CVE-2023-38180 is a denial-of-service vulnerability in Microsoft .NET and Visual Studio 2022 caused by uncontrolled resource consumption (CWE-400). Per the CVSS vector, a remote, unauthenticated attacker can trigger it over the network with no privileges or user interaction required, causing affected applications or services to exhaust resources and become unavailable. The attacker gains only availability impact (high availability severity, no confidentiality or integrity impact), but this can take down ASP.NET Core web applications and other .NET-based services. Any organization running vulnerable .NET runtimes, ASP.NET Core applications, or Visual Studio 2022 is exposed, and Fedora also ships affected .NET packages. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-08-09, it was among the two actively exploited flaws fixed in Microsoft's August 2023 Patch Tuesday, and EPSS assigns a 14.0% 30-day exploitation probability (96th percentile).
· microsoft .NET / .NET Core (including ASP.NET Core workloads) · microsoft ASP.NET Core KEVmass
Server-Side Request Forgery in GitLab Community and Enterprise Editions via CI Lint API
CVE-2021-39935 is a server-side request forgery (CWE-918) in GitLab Community Edition and Enterprise Edition that allows unauthorized external users to make the GitLab server issue requests through the CI Lint API. By abusing the server's network position, an attacker can reach internal-only resources such as loopback or private-network services, potentially mapping or accessing internal infrastructure without credentials. All deployments of the affected editions are potentially exposed, with actual risk depending on whether the CI Lint API is reachable by unauthenticated external users. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-03, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed. EPSS estimates a 35.6% probability of exploitation within 30 days (98th percentile).
Denial-of-Service in Apache Struts 1 ActionForm (pre-1.2.9)
Apache Struts 1 versions before 1.2.9, when used with BeanUtils 1.7, contain a denial-of-service vulnerability in how ActionForm beans are populated from request data. An attacker can send crafted HTTP request parameters that, when applied to an ActionForm via BeanUtils, consume excessive server resources and disrupt or crash the affected web application. The impact is availability only — no code execution or access — so an unauthenticated remote attacker gains the ability to degrade or take down the service. Any organization running legacy Java web applications built on Apache Struts 1 prior to 1.2.9 is affected. CISA added this flaw to its Known Exploited Vulnerabilities Catalog on 2022-01-21, confirming in-the-wild exploitation; no public proof-of-concept is known, and any ransomware association is not reported.
· Apache Struts 1 versions before 1.2.9 (when used with BeanUtils 1.7) KEVmass
Authenticated GraphQL Subscription Flaw Leaks Search Credentials in GitLab EE
GitLab EE contains a critical (CVSS 9.9) deserialization flaw (CWE-502) in which an authenticated user with Duo Chat access can pass a specially crafted GraphQL subscription argument that bypasses serialization and performs a server object lookup. Via this bypass, the attacker can obtain Advanced Search instance configurations and the sensitive credentials they contain. Because the attack requires only a low-privileged account with Duo Chat access over the network, with no user interaction, any EE deployment where Duo Chat is enabled is potentially exposed, including both self-managed instances and GitLab.com. Affected versions are EE 18.3 and later before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. No public proof-of-concept or CISA KEV listing exists for this CVE as of now, though related GitLab flaws disclosed in the same cycle are reportedly drawing internet-wide probing.
· GitLab EE all versions from 18.3 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2large
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0.
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.