GitLab CVSS 10.0 Flaw Exploited; CISA Deadline Is September 14

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026 — the agency's public statement that a maximum-severity flaw in GitLab is being used in real attacks. GitLab's own patch advisory describes the bug as a path traversal issue in the repository commits API: improper path confinement and missing authentication enforcement could let an unauthenticated user read arbitrary files from the GitLab server. GitLab scores it 10.0 out of 10.0 on CVSS, the highest the scale allows. CISA's catalog entry classifies it as CWE-35.

The sequence is what makes the case urgent. GitLab shipped the fixes on September 10, 2026, in versions 19.1.8, 19.2.6 and 19.3.2 for both Community Edition and Enterprise Edition. CISA listed the vulnerability as actively exploited one day later and set September 14, 2026 as the remediation date for US federal civilian agencies under Binding Operational Directive 26-04. The catalog entry also flags the CVE for forensic triage under that directive, which obliges agencies to check whether attackers compromised the system before the patch went on.

The exposure sits with organisations that run GitLab on their own infrastructure. GitLab lists the affected builds as 18.7 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1, and says GitLab.com already runs the patched code while GitLab Dedicated customers need take no action. A self-managed server is a dense target: it typically holds source code, CI/CD variables, deployment keys and integration tokens, which is precisely the material an unauthenticated file read can reach. The same release closed a second critical issue, CVE-2026-87719, rated 9.9 — according to GitLab, an authenticated user with Duo Chat access could obtain Advanced Search instance configurations and credentials through a crafted GraphQL subscription argument.

What remains unknown is who is exploiting the flaw, on what scale and against which organisations. No official statement names an attacker or a victim, and CISA's entry lists known ransomware campaign use as "Unknown". GitLab credits the researcher s3ntago with reporting the issue through its HackerOne bug bounty programme. Company policy is to publish the underlying issue-tracker entries 90 days after the release that patched them, which would put technical detail on CVE-2026-85706 around December 2026; until then, the upgrade is the only published remedy. The September 14 date binds US federal civilian agencies only — for everyone else, the KEV listing is CISA's signal that exploitation is already under way rather than theoretical.