CISA confirms active exploitation as watchTowr spots miscreants probing internet-facing servers

CISA says attackers are exploiting a maximum-severity GitLab flaw that lets unauthenticated miscreants read arbitrary files from vulnerable servers after the code shack released fixes on September 10.

The US Cybersecurity and Infrastructure Security Agency has 

The vulnerability is a path traversal bug in the repository commits API affecting GitLab Community Edition and Enterprise Edition. GitLab rates it a perfect 10.0, the maximum score on the CVSS v3.1 severity scale.

Under certain conditions, an attacker doesn't need to log in before abusing the flaw to read arbitrary files from the GitLab server. GitLab 

 the problem on improper path confinement combined with missing authentication enforcement in the affected API.

That's not an especially comforting combination on a platform that can be stuffed with source code, configuration files, and credentials.

security

bitdevs

devs

> **CISA confirms active exploitation as watchTowr spots miscreants probing internet-facing servers**
>
> CISA says attackers are exploiting a maximum-severity GitLab flaw that lets unauthenticated miscreants read arbitrary files from vulnerable servers after the code shack released fixes on September 10.
>
> The US Cybersecurity and Infrastructure Security Agency has [added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog](https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog).
>
> The vulnerability is a path traversal bug in the repository commits API affecting GitLab Community Edition and Enterprise Edition. GitLab rates it a perfect 10.0, the maximum score on the CVSS v3.1 severity scale.
>
> Under certain conditions, an attacker doesn't need to log in before abusing the flaw to read arbitrary files from the GitLab server. GitLab [blamed](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/) the problem on improper path confinement combined with missing authentication enforcement in the affected API.
>
> That's not an especially comforting combination on a platform that can be stuffed with source code, configuration files, and credentials.
>
> [**...read more at theregister.com**](https://www.theregister.com/security/2026/09/14/perfect-10-gitlab-bug-under-attack-days-after-patch-lands/5296176)