Over 8,300 Gitea servers vulnerable to code execution attacks
Found by web discovery while looking for coverage of CVE-2026-60004
Over 8,300 internet-facing Gitea servers are exposed to active exploitation of CVE-2026-60004, an authenticated code injection flaw enabling arbitrary code execution.
Attackers are targeting CVE-2026-60004, a code injection vulnerability in Gitea that lets authenticated attackers execute arbitrary code. The flaw was reported by Salesforce security researcher Shai Rod. Roughly 8,300 Gitea instances are estimated vulnerable, so administrators should patch promptly and check for compromise.
- CVE-2026-60004 allows authenticated attackers to execute arbitrary code
- Over 8,300 Gitea servers estimated vulnerable to exploitation
- Vulnerability credited to Salesforce researcher Shai Rod
- Exploitation activity against vulnerable instances is underway
- CVEs
- CVE-2026-60004
- Vendors
- GiteaSalesforce
- Products
- Gitea
- Organizations
- Salesforce
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection | 9.8 | 24% | KEVPoC ×5 | KEV |
From the original article
The code injection vulnerability (CVE-2026-60004) targeted in these attacks was reported by Salesforce security researcher Shai Rod, and it allows authenticated attackers to execute arbitrary ...
bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.