GitLab Emergency Patch Drops After Zero-Day Path Traversal Flaw Triggers In-The-Wild Exploits

PUBLISHED Sep 12, 2026, 7:24 PM ET

GitLab released emergency software patches to address a maximum-severity path traversal vulnerability tracked as CVE-2026-85706, which received a CVSS score of 10.0. Disclosed publicly on September 11, 2026, the flaw resides within the platform repository commits API and permits unauthenticated remote actors to read arbitrary files from target servers. Threat intelligence findings from watchTowr revealed active in-the-wild exploitation sweeps and network probes targeting corporate infrastructure starting at 06:00 UTC on the day of disclosure. The vulnerability exposes software build pipelines, source code repositories, and proprietary corporate assets on self-hosted and cloud-connected instances. Attackers can bypass authentication boundaries to harvest sensitive configuration credentials, environment variables, and database connection strings stored locally. GitLab urged administrators and enterprise organizations to apply the security updates immediately to block ongoing automated attacks and protect vulnerable infrastructure against supply chain compromise.

By Ayesha A. | JQJO News

Media Bias

Articles Published:: 27
Right Leaning:: 0
Left Leaning:: 0
Neutral:: 27

Explain Framing

Left: Emphasizes corporate security accountability and regulatory supply chain software risks. Center: Focuses strictly on technical vulnerability mechanics and patch deployment instructions. Right: Highlights corporate risk management and enterprise defense against foreign cyber threats.