**CISA** has added **CVE-2026-85706** to its catalog of actively exploited flaws, underscoring the critical risk it poses. This vulnerability affects **GitLab**'s widely used platform, which serves over 50% of Fortune 100 companies and boasts more than 30 million registered users globally. ### The Vulnerability Explained The flaw, designated **CVE-2026-85706**, is rooted in missing authentication enforcement and improper path confinement within the repository commits API. This oversight creates a critical window for unauthenticated attackers to exploit the system, granting them the ability to read arbitrary files containing sensitive information such as credentials and secrets from compromised servers. **GitLab** addressed this security issue promptly, releasing fixes for **GitLab Community Edition (CE)** and **Enterprise Edition (EE)** versions 19.3.2, 19.2.6, and 19.1. The company has strongly urged all users to apply these patches without delay. ### In-the-Wild Exploitation Confirmed While **GitLab** had not officially tagged the vulnerability as actively exploited at the time of the patch release, cybersecurity firm **watchTowr** reported active probing for unpatched **GitLab** servers just one day later. **watchTowr Intel** confirmed observing "in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, **CVE-2026-85706**, which allows attackers to read arbitrary files in a single HTTP request." **watchTowr** further cautioned, "Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away. [..] Defenders should also hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to identify potential exploitation attempts." ### CISA's Directive and Broader Implications On the same day as **watchTowr**'s alert, **CISA** added **CVE-2026-85706** to its authoritative catalog of actively exploited vulnerabilities. This action triggered **Binding Operational Directive (BOD) 26-04**, mandating federal agencies to secure their systems against this flaw within three days. Although **BOD 26-04** specifically targets federal civilian executive branch (FCEB) agencies, **CISA** emphasized that all network defenders, including those in the private sector, should prioritize patching their systems immediately. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," **CISA** stated, encouraging all organizations to adopt risk-based vulnerability management and prioritize remediation of **KEV Catalog** vulnerabilities. This isn't the first time **GitLab** has faced critical security challenges. In January, the company patched a high-severity two-factor authentication bypass flaw. Since November 2021, **CISA** has identified four **GitLab** vulnerabilities as actively exploited, including **CVE-2021-22175** and **CVE-2021-39935** earlier this year.