Perfect-10 GitLab bug under attack days after patch lands
CISA confirms active exploitation of CVSS 10.0 GitLab path traversal flaw CVE-2026-85706 days after patches shipped, enabling unauthenticated arbitrary file reads.
CISA added CVE-2026-85706, a maximum-severity 10.0 CVSS path traversal flaw in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog and confirmed active exploitation. The bug allows unauthenticated attackers to read arbitrary files, including configuration data and credentials, from self-managed GitLab CE/EE servers via a single HTTP POST request. GitLab shipped fixes on September 10 in versions 19.3.2, 19.2.6, and 19.1.8, covering versions 18.7 through 19.3. watchTowr is observing probes against internet-facing instances and warns widespread exploitation is likely to follow quickly.
- CVE-2026-85706 is a CVSS 10.0 unauthenticated path traversal in GitLab commits API
- CISA added the flaw to the KEV catalog, confirming active exploitation
- Patches shipped September 10 in GitLab 19.3.2, 19.2.6, and 19.1.8
- Exploitation requires a single HTTP POST with crafted file.path parameter
- watchTowr observed probing of internet-facing self-hosted instances over the weekend
- CVEs
- CVE-2026-85706
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85706 | Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE | 10.0 | 97% | KEVPoC ×13 | KEV |
From the original article
2 min read at theregister.comCISA confirms active exploitation as watchTowr spots miscreants probing internet-facing servers
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.