Vulnerabilities · 4h ago

Active GitLab RCE attacks put hosted code at risk

BleepingComputer reports attackers are actively exploiting a remote code execution (RCE) flaw in GitLab CE/EE, with more than 1,000 internet-exposed servers still unpatched. The flaw is tracked as CVE-2026-85706, which is listed in CISA’s Known Exploited Vulnerabilities catalog; its federal remediation deadline has passed.

The flaw lets attackers run commands on a vulnerable GitLab server. Because GitLab hosts source code and development workflows, a successful compromise could put those assets within reach—but the reporting does not establish that any specific instance or repository was accessed.

If an organization’s repositories or build workflows sit on an exposed instance, including one operated by a supplier, the risk reaches into its development environment. The scale of exposure is reported; the extent of any resulting access remains unknown.

CVE-2026-85706

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: gitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6…

CISA federal remediation date Sep 14 · date passed

Timeline

Nov 2 Reported by BleepingComputer
Sep 14 CISA federal deadline for CVE-2026-85706 passed
Sep 11 CVE-2026-85706 added to CISA KEV

Sources

1 source covering this story

BleepingComputer Nov 2
Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks.

Entities

CVE-2026-85706

Part of the PlainSec briefing for 2026-11-02

Editions

Briefing for 2026-11-02

Vulnerabilities · 4h agoActive GitLab RCE attacks put hosted code at riskBleepingComputer reports attackers are actively exploiting a remote code execution (RCE) flaw in GitLab CE/EE, with more than 1,000 internet-exposed servers still unpatched. The flaw is tracked as CVE-2026-85706, which is listed in CISA’s Known Exploited Vulnerabilities catalog; its federal remediation deadline has passed.The flaw lets attackers run commands on a vulnerable GitLab server. Because GitLab hosts source code and development workflows, a successful compromise could put those assets within reach—but the reporting does not establish that any specific instance or repository was accessed.If an organization’s repositories or build workflows sit on an exposed instance, including one operated by a supplier, the risk reaches into its development environment. The scale of exposure is reported; the extent of any resulting access remains unknown.