Bleepingcomputer Critical Gitea Vulnerability CVE-2026-60004 Actively Exploited
Article Content
- •CVE-2026-60004 allows arbitrary command execution on vulnerable Gitea instances.
- •CISA has mandated federal agencies to secure their Gitea servers by August 28, 2026.
- •Gitea version 1.27.1 was released to address this critical vulnerability.
A critical vulnerability in Gitea, tracked as CVE-2026-60004, is being actively exploited by attackers, allowing unauthorized users to execute arbitrary shell commands on vulnerable servers. This flaw affects self-hosted Gitea instances, particularly those with default configurations that permit self-registration. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to secure their servers by August 28, 2026. Gitea released version 1.27.1 on July 27, 2026, to patch this vulnerability. Reports indicate that attackers are deploying cryptocurrency mining malware on unpatched servers. CISA has emphasized the significant risks posed by this vulnerability to federal enterprises. Additionally, another critical vulnerability, CVE-2026-20896, was previously exploited in July 2026, indicating ongoing security challenges for Gitea users.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (31)
Following this threat?
Track CVE-2026-20896 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…