CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities catalog on September 11, 2026, flagging a bug that lets anyone read files off a GitLab Community Edition or Enterprise Edition server without logging in. Federal agencies have three days to fix it.
What Is It
CVE-2026-85706 is a path traversal vulnerability in GitLab Community Edition and Enterprise Edition. According to the CISA KEV entry, two mistakes combine to cause it: the repository commits API doesn't keep file requests inside the directory they're supposed to stay in, and it doesn't check whether the person making the request is logged in. Put together, someone with no account at all can ask the server for any file on disk and get it.
No CVSS score, severity rating, vector string, or CWE classification was available in the NVD record at the time of writing; the NVD entry is currently empty.
Why It Matters
A spot in the CISA KEV catalog means attackers are already using this against real systems, not just that someone found it. Two details make it more pressing than a typical KEV entry. First, the KEV entry sets a due date of September 14, 2026; three days after the September 11 addition. CISA normally gives weeks. A window that short suggests the agency considers exploitation widespread or fast-moving, though CISA has not published its reasoning for the compressed timeline. Second, the KEV entry flags the vulnerability under CISA's forensics triage requirements: affected organizations are expected to go look through logs and systems for evidence that someone already got in, not just install the patch and call it done.
The attacker needs no username or password. GitLab servers commonly hold source code, CI/CD secrets, deployment credentials, and API tokens; so depending on what a given instance stores and how its secrets are managed, arbitrary file read on an exposed server could expose credentials that reach well beyond GitLab itself.
The KEV entry lists known ransomware campaign use as Unknown.
What's Vulnerable
GitLab Community Edition and Enterprise Edition. CISA's entry does not list specific version ranges, and NVD has no affected CPE data. The vendor reference points to the GitLab 19.3.2 patch release, which is the advisory to work from.
Patch Status
CISA's required action, as stated in the KEV entry: apply mitigations per vendor instructions in accordance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. For cloud services, follow applicable BOD 26-04 guidance, or stop using the product if no fix is available. Organizations are expected to work out which of their instances can be reached from the internet and to follow the BOD 26-04 patching rules for each one.
Due date: September 14, 2026.