GitLab Patches Maximum-Severity CVSS 10.0 Flaw as CISA Confirms Active Exploitation
GitLab Patches Maximum-Severity CVSS 10.0 Flaw as CISA Confirms Active Exploitation
GitLab has released emergency patches for a vulnerability rated at the maximum possible severity score, and within a day, the Cybersecurity and Infrastructure Security Agency confirmed the flaw was already being exploited in the wild. The rapid timeline has drawn attention from security researchers and put administrators of self-managed GitLab instances on notice to act quickly.
CVE-2026-85706 is an unauthenticated path traversal flaw in GitLab's repository commits API. It received a CVSS score of 10.0, the highest rating on the scale, reflecting the ease of exploitation and severity of potential impact. GitLab released patched versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, known as the KEV, just one day later, on September 11, 2026.
What the Vulnerability Allows
According to GitLab's own release notes, the flaw permits unauthenticated attackers to read arbitrary files on affected self-managed GitLab Community Edition and Enterprise Edition instances. This creates exposure risk for credentials, SSH configurations, and CI/CD secrets stored on vulnerable systems.
Affected versions span releases prior to 19.1.8, 19.2.6, and 19.3.2. Beyond direct file exposure, security researchers have noted the potential for downstream impact, including unauthorized source code access and compromise of build pipelines if exposed CI/CD secrets are misused.
From Patch to Active Exploitation in Under 24 Hours
Security vendor watchTowr reported that its honeypot network observed behavioral probes targeting the vulnerability beginning around 06:00 UTC on September 11, 2026, just hours after patches were released. Rapid7 and Horizon3.ai separately reported probing or exploitation-related activity around the same window.
Independent of these vendor reports, CISA's decision to add the vulnerability to its KEV catalog provides government validation that exploitation has occurred, since KEV listings require confirmed evidence of active exploitation rather than theoretical risk. Federal Civilian Executive Branch agencies are required under CISA directives to remediate the flaw by September 14, 2026.
A Second Critical Flaw in the Same Release
GitLab's September 10 patch cycle also addressed a second critical issue, CVE-2026-87719, a deserialization vulnerability rated CVSS 9.9. The near-simultaneous disclosure of two maximum-or-near-maximum severity flaws in a single release has prompted some observers to note a broader pattern of high-severity issues surfacing in GitLab's codebase in short succession. This follows other critical GitLab vulnerabilities disclosed in recent history, and some in the security community have raised questions about the platform's ongoing hardening efforts, though a definitive causal pattern has not been established by an authoritative source.
Separating Confirmed Facts from Vendor Risk Assessment
It is worth distinguishing between what has been independently confirmed and what remains vendor commentary. GitLab's patch notes confirming affected versions and the CVSS 10.0 rating, along with CISA's KEV catalog addition and the National Vulnerability Database's CVE record, represent independently verifiable facts from authoritative sources.
By contrast, some of the more urgent language describing "indiscriminate mass exploitation" and imminent widespread compromise originates primarily from watchTowr, a commercial security vendor whose public writeup mixes technical findings with promotional references to its own products. A recurring concern among security researchers is that exploitation could scale quickly given the flaw's simplicity, but readers should treat forward-looking claims about exploitation scale as vendor risk assessment rather than confirmed incident data. Corroboration from Rapid7 and Horizon3.ai lends some additional weight to the probing reports, though the full extent of exploitation across the internet has not been independently quantified in the sources reviewed.
What Administrators Should Do Now
Security researchers and GitLab itself recommend that administrators of self-managed instances patch immediately to versions 19.3.2, 19.2.6, or 19.1.8, or later. Reviewing server and application logs for unusual access patterns to the commits API, particularly over the days surrounding the disclosure, may help identify whether exploitation occurred prior to patching.
As a precaution, many observers suggest rotating potentially exposed credentials, SSH keys, and CI/CD secrets on affected instances, given the nature of the file-read vulnerability. Continued monitoring of the CISA KEV catalog and official GitLab advisories is advised as the situation develops.