Back Securityweek GitLab Vulnerability Exploited One Day After Disclosure
Threat actors have started exploiting a newly patched vulnerability in GitLab one day after public disclosure, attack surface management firm WatchTowr warns.
Tracked as CVE-2026-85706 (CVSS score of 10/10), the security defect is described as a path traversal issue that can allow unauthenticated users to read arbitrary files from the GitLab server.
All Community Edition (CE) and Enterprise Edition (EE) versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected.
On Friday, one day after GitLab announced patches for the security weakness, WatchTowr observed the first in-the-wild exploitation attempts targeting it.
“WatchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request,” the company said .
According to WatchTowr, mass exploitation of the vulnerability is likely to follow shortly.
“Defenders should hunt through log files for HTTP POST requests to ‘/api/v4/projects/{id}/repository/commits/’ URIs containing ‘file.path’ parameters to identify potential exploitation attempts,” the company noted.
Self-hosted GitLab instances should be upgraded as soon as possible, as the fresh patches resolve 17 other vulnerabilities, including another critical-severity bug.
The critical flaw, tracked as CVE-2026-87719 (CVSS score of 9.9/10), is an insecure deserialization issue in the GraphQL subscription serializer that could allow attackers to access “Advanced instance configurations and sensitive credentials”.
GitLab CE/EE versions 19.1.8, 19.2.6, and 19.3.2 also resolve six high-severity security defects that could allow attackers to achieve remote code execution, access protected CI/CD variables, mount XSS attacks, and cause denial-of-service conditions.
Related: In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review
Related: Check Point Patches Critical VPN Vulnerabilities
Related: PaperCut Flaws Exploited in AI-Powered Attacks
Related: Critical NetScaler Vulnerability Exploited in Attacks
Ionut Arghire is an international correspondent for SecurityWeek.
More from Ionut Arghire
PaperCut Flaws Exploited in AI-Powered Attacks
Critical NetScaler Vulnerability Exploited in Attacks
4.1 Million Impacted by AdaptHealth Data Breach
New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender
Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
HelmGuard Raises $7.3 Million for Agentic GRC and Security
Android’s September 2026 Updates Patch 180 Vulnerabilities
Chipmaker Patch Tuesday: Nvidia, AMD, Arm Issue Security Advisories
Phishing Research Challenges Conventional Security Awareness Testing
In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review
Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
Ukrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison
Check Point Patches Critical VPN Vulnerabilities
Kiteworks Acquires Bonfy.AI to Fill the AI Gap in Data Governance
Surfshark Systems Targeted by Hackers
Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion
Flipboard Whatsapp Whatsapp Email
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
