GitLab Path Traversal Vulnerability Actively Exploited Hours After Patch Release
A critical path traversal vulnerability in GitLab, CVE-2026-85706, is being actively exploited in the wild just one day after patches were made available, highlighting the rapid threat actor response to newly disclosed flaws.
Threat actors have begun actively exploiting a critical path traversal vulnerability in GitLab, mere hours after the vendor released patches for the flaw. The vulnerability, tracked as CVE-2026-85706, carries a maximum CVSS score of 10/10 and allows unauthenticated attackers to read arbitrary files from a vulnerable GitLab server with a single HTTP request.
Attack surface management firm WatchTowr first observed in-the-wild exploitation attempts on Friday, September 11, 2026, just one day after GitLab announced the availability of fixes. The company warned that mass exploitation of the vulnerability is likely to follow swiftly, urging defenders to implement immediate protective measures.
GitLab versions affected by this critical path traversal flaw include all Community Edition (CE) and Enterprise Edition (EE) versions from 18.7 prior to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The rapid exploitation underscores a growing trend where vulnerabilities are weaponized by malicious actors almost immediately after public disclosure, leaving little time for organizations to apply patches.
To detect potential exploitation attempts, WatchTowr advises security teams to scrutinize log files for specific HTTP POST requests. The indicators include requests targeting the URI /api/v4/projects/{id}/repository/commits/ that contain file.path parameters. This specific pattern can help identify reconnaissance or active exploitation activities.
This critical vulnerability was patched alongside 17 other security defects in the latest GitLab releases. Among these were other significant flaws, including CVE-2026-87719, an insecure deserialization issue in the GraphQL subscription serializer. This separate critical bug (CVSS 9.9/10) could allow attackers to access advanced search instance configurations and sensitive credentials.
The recent GitLab patch batch also addresses six high-severity vulnerabilities. These defects could enable attackers to achieve remote code execution, gain unauthorized access to protected CI/CD variables, launch cross-site scripting (XSS) attacks, or cause denial-of-service conditions. The comprehensive nature of the fixes highlights the ongoing security challenges faced by complex software platforms.
Organizations running self-hosted GitLab instances are strongly urged to upgrade to the latest patched versions as soon as possible to mitigate the immediate threat posed by CVE-2026-85706 and the other vulnerabilities. The swift exploitation of this path traversal flaw serves as a stark reminder of the critical importance of timely vulnerability management and patching in today's threat landscape.
This new report from CyberScoop provides further details on the ongoing exploitation of GitLab's CVE-2026-85706, noting that internet-wide probes were detected by WatchTowr Labs shortly after GitLab released emergency patches. The article also details a second critical vulnerability, CVE-2026-87719, affecting GitLab Enterprise Edition, which allows authenticated users to exfiltrate settings and passwords.
CISA has officially added CVE-2026-85706, a path traversal vulnerability affecting GitLab Community Edition and Enterprise Edition, to its Known Exploited Vulnerabilities (KEV) Catalog. This inclusion signifies that CISA has confirmed active exploitation of the flaw in the wild, underscoring the immediate risk it poses to federal agencies and other organizations.
The US Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) Catalog, mandating its remediation for federal agencies by September 15th. This inclusion underscores the critical nature of the path traversal flaw and its potential impact on government systems, while also serving as a strong recommendation for private sector organizations to prioritize patching.