GitLab CVE-2026-85706 Added to CISA KEV
CISA added CVE-2026-85706 to KEV: a path traversal in GitLab CE/EE letting unauthenticated attackers read arbitrary files.
CVE-2026-85706 is a severe path traversal flaw in GitLab CE and EE that permits unauthenticated remote actors to retrieve arbitrary files from affected self-managed deployments. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating exploitation has been observed. Organizations running self-managed GitLab instances should prioritize patching.
- Path traversal in GitLab CE/EE enables unauthenticated arbitrary file retrieval on self-managed deployments.
- CISA's KEV addition signals confirmed exploitation in the wild.
- Federal agencies and self-hosted GitLab operators should patch promptly per BOD 22-01 timelines.
- CVEs
- CVE-2026-85706
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
From the original article
GitLab CVE-2026-85706 Added to CISA KEV CVE-2026-85706 represents a severe path traversal flaw in GitLab CE and EE, permitting unauthenticated remote actors to retrieve arbitrary files from affected self-managed deployme
By ameer · socradar.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.