A Critical GitLab Vulnerability is Being Exploited Just One Day After Disclosure
Security firm WatchTowr has warned that threat actors are already targeting a newly patched vulnerability in GitLab, one day after the company announced fixes for the security weakness. The vulnerability, tracked as CVE-2026-85706, allows unauthenticated users to read arbitrary files from the GitLab server, making it a highly attractive target for attackers.
The issue is particularly concerning because it affects all versions of GitLab’s Community Edition (CE) and Enterprise Edition (EE) from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. In other words, a significant number of users are at risk of being compromised unless they take immediate action to patch their systems.
WatchTowr’s threat intelligence team has already observed in-the-wild exploitation attempts targeting the vulnerability, which is described as a path traversal issue that can allow attackers to read arbitrary files from the GitLab server. This type of attack is often used to gain unauthorized access to sensitive data or to inject malicious code into build pipelines.
According to Jake Knott, head of threat intelligence at WatchTowr, mass exploitation of the vulnerability is likely to follow shortly. “Defenders should hunt through log files for HTTP POST requests to ‘api/v4/projects/{id}/repository/commits/’ URIs containing ‘file.path’ parameters to identify potential exploitation attempts,” he noted.
The situation is even more alarming because this is not an isolated incident. In recent weeks, WatchTowr has observed a critical-severity GitLab vulnerability being actively exploited just days after disclosure. This highlights the importance of patching vulnerabilities in a timely manner and underscores the need for organizations to prioritize their cybersecurity posture.
In addition to CVE-2026-85706, the recently released patches also resolve 17 other vulnerabilities, including another critical-severity bug tracked as CVE-2026-87719. This vulnerability is an insecure deserialization issue in the GraphQL subscription serializer that could allow attackers to access “Advanced Search instance configurations and sensitive credentials”.
The take away from this story is clear: organizations using GitLab must prioritize patching their systems immediately to prevent unauthorized access and potential data breaches. Self-hosted instances should be upgraded as soon as possible, and users are advised to monitor their log files for any signs of exploitation attempts.
In the face of increasingly sophisticated attacks, it’s more important than ever for security teams to stay vigilant and proactive in addressing vulnerabilities before they can be exploited. By prioritizing patching and monitoring, organizations can reduce their attack surface and protect themselves from potential threats.
Source: SecurityWeek — 2026-09-11