sign in--:--:--UTC

CVE-2026-85706

exploited in the wild☆ pin

CVSS

10.0

Reports

11

First seen

Sep 11, 2026

Last seen

Oct 2, 2026

Affected product

GitLab Community Edition and Enterprise Edition

Associated actors

APT29 ×1 China-aligned espionage groups (BlueMoon campaign) ×1 GoldFactory ×1 OpenAI agents (malicious swarm) ×1 ShinyHunters ×1 UNC3569 ×1

Recent reports

GitLab warns of critical RCE vulnerability in AI Gateway service

Bleeping ComputerOct 2, 2026 High

GitLab High-Risk Security Vulnerabilities CVE-2026-85706 and CVE-2026-87719 Require Immediate Patching

NICS TaiwanSep 22, 2026 High

Weekly Recap: AI Agents in Attacks, RubyGems Compromise, WeChat Worm, PaperCut Exploitation

The Hacker NewsSep 14, 2026 Medium

Weekly Threat Intelligence Report – 14 September 2026

Check Point ResearchSep 14, 2026 Critical

CISA: Hackers exploit maximum-severity GitLab authentication bypass flaw

Bleeping ComputerSep 14, 2026 Medium

GitLab Multiple Vulnerabilities

HKCERTSep 14, 2026 High

GitLab security advisory – CVE-2026-85706 added to CISA KEV

Canadian Centre AlertsSep 11, 2026 Critical

GitLab critical path traversal flaw (CVE-2026-85706) under active probing

CyberScoopSep 11, 2026 Critical

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

The Hacker NewsSep 11, 2026 High

CISA Adds GitLab Path Traversal Vulnerability to Known Exploited Vulnerabilities Catalog

CISA AdvisoriesSep 11, 2026 Critical

GitLab urges users to patch maximum-severity path traversal flaw CVE-2026-85706

Bleeping ComputerSep 11, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign up See plans