Advisories
CISA Adds GitLab Path Traversal CVE‑2026‑85706 to KEV Catalog, Urges Rapid Patch
CISA has added CVE‑2026‑85706, a path‑traversal flaw in GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The update reinforces BOD‑26‑04, which requires federal civilian agencies to prioritize remediation of high‑risk KEVs on exposed assets. All organizations should patch immediately and can submit other KEV candidates via CISA’s nomination form.
New KEV Entry
CISA’s latest addition to the Known Exploited Vulnerabilities (KEV) catalog is CVE‑2026‑85706, a path‑traversal vulnerability that allows attackers to read arbitrary files on GitLab servers. The flaw is present in both Community Edition (CE) and Enterprise Edition (EE) and has been actively exploited in the wild.
Why It Matters for Federal Agencies
Binding Operational Directive (BOD) 26‑04: Prioritizing Security Updates Based on Risk mandates that Federal Civilian Executive Branch (FCEB) agencies treat KEV‑listed CVEs as high‑risk. Agencies must:
- Apply patches on publicly exposed GitLab instances immediately.
- Verify whether a system has been compromised before a patch is deployed.
- Defer lower‑risk vulnerabilities until the high‑risk ones are remediated.
While BOD 26‑04 applies only to FCEB agencies, CISA encourages all organizations to adopt a risk‑based approach and prioritize KEV remediation.
How to Get Involved
Organizations that discover an actively exploited vulnerability not yet in the KEV catalog can submit it via CISA’s KEV Nomination Form. Submissions must include a CVE ID, proof of exploitation, and clear mitigation guidance.
"CISA will continue to add vulnerabilities to the catalog that meet the specified criteria."
Take Action Now
Patch GitLab installations, validate that the patch is in place, and check for signs of compromise. If you suspect a related exploit, report it immediately to CISA.
Related vulnerabilities
CISA Expands KEV Catalog with GitLab Path Traversal CVE-2026-85706
CISA has added CVE-2026-85706, a path‑traversal flaw in GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog after confirmed active exploitation. The move reinforces the agency’s push for rapid patching of high‑risk bugs under BOD 26‑04 and serves as a reminder for all organizations to prioritize KEV fixes.
Read briefing
CISA Warns of Active Exploitation Targeting Critical GitLab Path Traversal Flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical GitLab path traversal vulnerability, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog following reports of active in-the-wild scanning. The flaw allows unauthenticated remote attackers to extract sensitive files and credentials from vulnerable instances using a single HTTP request. Organizations running affected versions are urged to apply patches immediately.
Read briefing
GitLab Urges Immediate Patch for CVE‑2026‑85706 Path Traversal Flaw – Attackers Already Scanning
GitLab has released critical security updates for two high‑severity bugs: CVE‑2026‑85706, an unauthenticated path traversal that can expose arbitrary files, and CVE‑2026‑87719, an insecure deserialization flaw that lets privileged users harvest credentials. The first flaw was discovered by researcher s3ntago via GitLab’s HackerOne program, and watchdog firm watchTowr reports attackers are already probing exposed instances. All self‑managed GitLab installations must upgrade to the patched 19.3.2/19.2.6/19.1 releases immediately. The platform serves over 30 million users, including more than 50%
Read briefing
CISA Adds Zimbra OS Command Injection CVE‑2026‑73570 to KEV Catalog
CISA has just added CVE‑2026‑73570, an OS command injection vulnerability in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities (KEV) list after confirmed active exploitation. Federal agencies are now required to patch this flaw immediately under BOD 26‑04, while all organizations are urged to adopt a risk‑based remediation strategy. The KEV catalog will expand as more exploited CVEs surface, and entities can nominate new entries via CISA’s KEV Nomination Form.
Read briefing