CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-85706, an actively exploited GitLab path traversal flaw, to its KEV Catalog, requiring federal agencies to prioritize patching.
CISA added one vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-85706, a path traversal vulnerability in GitLab Community Edition and Enterprise Edition. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets, including checking whether systems were compromised before the patch was applied. While BOD 26-04 binds only FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediations.
- CVE-2026-85706 is a path traversal flaw in GitLab CE and EE with evidence of active exploitation
- BOD 26-04 requires FCEB agencies to rapidly patch KEV vulnerabilities on exposed assets
- Agencies must verify whether threat actors compromised systems before patching
- CISA encourages all organizations to prioritize KEV remediations via risk-based vulnerability management
- KEV nominations require a CVE ID, exploitation evidence, and clear mitigation guidance
- CVEs
- CVE-2026-85706
- Vendors
- GitLab
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
From the original article
1 min read at cisa.govCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.