GitLab maximum-severity flaw moves onto active-exploitation list after fixes

Exploitation listed days after fixes were released

The Register reported that CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog and said attackers were exploiting it. The path-traversal flaw—an error that can let a request reach files outside its intended path—affects the GitLab repository commits API. Under certain conditions, an unauthenticated attacker could read arbitrary files from a vulnerable server. GitLab released fixes in versions 19.3.2, 19.2.6, and 19.1.8; watchTowr reportedly observed probing of internet-facing servers.

GitLab issued fixes on September 10 for affected self-managed installations; GitLab.com was already patched.

The reported security state shifted from a newly patched maximum-severity flaw to one listed by CISA as actively exploited, with watchTowr reporting probes against internet-facing servers.

The reported shift to active exploitation came only days after fixes were released. The flaw's maximum CVSS 10.0 score, lack of required login under certain conditions, and potential access to local files and credentials make patching exposed self-managed installations a reported priority.