CRITICAL 10.0 NVD ACTIVELY EXPLOITED
CVE-2026-85706
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain co
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
References
- https://gitlab.com/gitlab-org/gitlab/-/work_items/627748
- https://hackerone.com/reports/3909881
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706
This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-09-12 via NVD. ⚠ This vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being actively exploited in the wild.
Risk Timeline
CVE Disclosed2026-09-12 · -1 days ago
CISA KEV — Actively ExploitedU.S. federal agencies required to patch · confirmed threat-actor activity
Remediation Resources
Analysis & PoC
gitlab.com/gitlab-org/gitlab/-/work_items/627748Analysis & PoC
hackerone.com/reports/3909881
vulnfeed aggregates 12842 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.