**GitLab** has released emergency patches to address several security flaws, including a critical vulnerability that has quickly become a target for in-the-wild probes. The immediate exploitation attempts highlight the urgency for IT security professionals to act. ### Unauthenticated File Read via Path Traversal The most severe of the patched vulnerabilities is **CVE-2026-85706** (CVSS score: 10.0), a path traversal issue found in the repository commits API. This flaw could enable an unauthenticated attacker to read arbitrary files directly from the **GitLab** server, provided certain conditions are met. According to **GitLab**, the root cause lies in "improper path confinement and missing authentication enforcement in the repository commits API." ### Affected Versions The vulnerability impacts the following versions of **GitLab Community Edition (CE)** and **Enterprise Edition (EE)**: * All versions from 18.7 before 19.1.8 * All versions from 19.2 before 19.2.6 * All versions from 19.3 before 19.3.2 ### Active Exploitation Confirmed Preemptive exposure management firm **watchTowr** reported observing active in-the-wild probes targeting **CVE-2026-85706** since 06:00 UTC on September 11, 2026. The firm warns that this vulnerability allows external attackers to access log files and **GitLab**-specific configuration files, potentially leading to the compromise of credentials, secrets, and other sensitive information. Jake Knott, head of threat intelligence at **watchTowr**, emphasized the severity: "This is the second instance of a critical severity **GitLab** vulnerability in recent weeks, following the previous GraphQL code injection (**CVE-2026-19478**) that was almost immediately actively exploited." He added that exploitation merely requires the existence of at least one public project. Knott highlighted the appeal for attackers: "The appeal to attackers of **GitLab** is obvious, as unauthorized access allows an attacker to gain access to source code, CI/CD secrets, credentials, and the ability to inject code into build pipelines, gaining access or poisoning anything downstream of it, which as we've seen throughout this year has been a favorite of attackers." ### Additional Critical Vulnerability Patched Alongside **CVE-2026-85706**, **GitLab** also patched **CVE-2026-87719** (CVSS score: 9.9), a critical insecure deserialization bug affecting **GitLab EE**. This flaw could lead to information disclosure, allowing an authenticated user with **Duo Chat** access to obtain **Advanced Search** instance configurations and sensitive credentials through a specially crafted **GraphQL** subscription argument. ### Call to Action for Defenders Organizations operating self-managed **GitLab** instances exposed to the internet must apply the latest patches (versions 19.3.2, 19.2.6, and 19.1.8) without delay. If immediate patching is not feasible, limiting public access to these instances is a critical interim measure. Knott reiterated the urgency: "Based on the history, the transition of this vulnerability to indiscriminate mass exploitation is likely not far away, and defenders have limited time to act." He also advised organizations to review log files for HTTP POST requests to `'/api/v4/projects/{id}/repository/commits/'` URIs containing `'file.Path'` parameters to identify potential exploitation attempts. ### CISA Adds to KEV Catalog The U.S. **Cybersecurity and Infrastructure Security Agency (CISA)** confirmed reports of active exploitation by adding **CVE-2026-85706** to its **Known Exploited Vulnerabilities (KEV)** catalog on September 11, 2026. Federal Civilian Executive Branch (**FCEB**) agencies are mandated to apply the necessary fixes by September 14, 2026, underscoring the severe risk posed by this vulnerability.