CVE-2026-85706
Known exploited · CISA KEV
CVSS 10 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6…
CISA federal remediation date Sep 14 · date passed
Vulnerabilities & Exploits
BleepingComputer reports attackers are actively exploiting a remote code execution (RCE) flaw in GitLab CE/EE, with more than 1,000 internet-exposed servers still unpatched. The flaw is tracked as CVE-2026-85706, which is listed in CISA’s Known Exploited Vulnerabilities catalog; its federal remediation deadline has passed.
The flaw lets attackers run commands on a vulnerable GitLab server. Because GitLab hosts source code and development workflows, a successful compromise could put those assets within reach—but the reporting does not establish that any specific instance or repository was accessed.
If an organization’s repositories or build workflows sit on an exposed instance, including one operated by a supplier, the risk reaches into its development environment. The scale of exposure is reported; the extent of any resulting access remains unknown.
1 source · 5h ago
Known exploited · CISA KEV
CVSS 10 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6…
CISA federal remediation date Sep 14 · date passed
BleepingComputer
Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks.
originalPart of the PlainSec briefing for 2026-11-02
Every edition of this story: Active GitLab RCE attacks put hosted code at risk