GitLab Users Urged to Act Quickly After Critical Vulnerability Exploitation Spotted Just One Day After Patch Release
A newly patched vulnerability in GitLab has been exploited by threat actors just 24 hours after it was publicly disclosed, according to a warning from attack surface management firm WatchTowr. The security weakness, known as CVE-2026-85706, is a path traversal issue that allows unauthenticated users to read arbitrary files on the affected system.
All Community Edition (CE) and Enterprise Edition (EE) versions of GitLab prior to 19.3.2 are vulnerable, including those from version 18.7 before 19.1.8, and 19.2 before 19.2.6. The patches released by GitLab on Friday resolve not only this critical vulnerability but also another 17 security defects, six of which are high-severity issues that could allow attackers to execute code remotely, access protected CI/CD variables, or cause denial-of-service conditions.
WatchTowr’s threat intelligence team has observed the first in-the-wild exploitation attempts targeting the newly patched vulnerability. The company warns that mass exploitation is likely to follow shortly and advises defenders to hunt through log files for HTTP POST requests containing specific URIs to identify potential exploitation attempts.
The critical flaw, tracked as CVE-2026-87719, is an insecure deserialization issue in the GraphQL subscription serializer that could allow attackers to access advanced search instance configurations and sensitive credentials. This vulnerability is particularly concerning, as it could be exploited by unauthorized users to gain access to source code, CI/CD secrets, and other sensitive information.
According to Jake Knott, head of threat intelligence at WatchTowr, the appeal of GitLab’s vulnerabilities to attackers lies in their ability to grant unauthorized access to critical system components. “The ease with which an attacker can inject code into build pipelines, gain access to or poison downstream systems, has been a favorite tactic of attackers this year,” Knott noted.
In light of these developments, self-hosted GitLab instances should be upgraded as soon as possible to the latest version. Users are advised to review their system logs for signs of exploitation and take immediate action to mitigate potential damage. The recent exploitation of this critical vulnerability serves as a stark reminder of the importance of timely patching and ongoing security vigilance in today’s digital landscape.
As we’ve seen in other high-profile incidents, the speed at which vulnerabilities are exploited can be alarming. In this case, it took just 24 hours for threat actors to capitalize on the newly patched vulnerability. This emphasizes the need for organizations to stay vigilant and proactive in their cybersecurity posture, regularly reviewing system logs, patching software promptly, and implementing robust security measures to prevent unauthorized access.
Source: SecurityWeek — 2026-09-11