CISA adds GitLab path traversal to KEV list
CISA added CVE-2026-85706, a GitLab CE/EE path traversal flaw under active exploitation, to its Known Exploited Vulnerabilities catalog.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-85706 as exploited in the wild.
CISA has added one vulnerability, CVE-2026-85706, affecting GitLab Community Edition and Enterprise Edition, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. The flaw is a path traversal vulnerability, a class of bug frequently used by attackers to read or access files outside intended directories, potentially exposing sensitive data or enabling further compromise on affected GitLab instances.
Under Binding Operational Directive (BOD 26-04), Federal Civilian Executive Branch (FCEB) agencies are required to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets, particularly those that could grant an attacker full control post-exploitation, and to check for prior compromise before patching. While the directive is mandatory only for FCEB agencies, CISA recommends all organizations running GitLab CE/EE identify affected instances, apply vendor patches promptly, and review logs for indicators of exploitation predating remediation. No specific IOCs, threat actor attribution, or exploitation details were provided in this alert; organizations should consult GitLab's advisory for patch versions and further technical detail.
Defenders should treat this as a routine but time-sensitive patch-management action: confirm GitLab version exposure, prioritize internet-facing instances, and apply available fixes without delay given confirmed active exploitation.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs