CVE-2026-85706: GitLab Path Traversal Added to CISA KEV — Patch by September 14, 2026

TL;DR

CISA added CVE-2026-85706, a path traversal vulnerability in GitLab Community Edition and Enterprise Edition, to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-11, with a remediation due date of 2026-09-14. The flaw allows an unauthenticated user to read arbitrary files through the repository commits API due to improper path confinement and missing authentication enforcement. If you run GitLab CE/EE, inventory exposed instances today, apply the vendor's patch release, and treat any internet-facing deployment as the top of your queue.

What is this vulnerability?

• CVE ID: CVE-2026-85706
• Vendor / Product: GitLab / Community Edition and Enterprise Edition
• Vulnerability name: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
• Weakness class: CWE-35 (Path Traversal)
• CISA KEV status: Yes — added 2026-09-11
• CISA due date: 2026-09-14
• Known ransomware use: Unknown
• Summary: GitLab CE/EE contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files. The root cause is improper path confinement combined with missing authentication enforcement in the repository commits API.
• Required action (per CISA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Because the vulnerability is reachable without authentication, exposure is not limited to authenticated insiders — any network path to the affected API is a potential entry point for file disclosure.

KEV vs CVSS vs EPSS

Signal	What it measures	How to use it for this CVE
CISA KEV	Confirmed exploitation in the wild, with a binding remediation due date for U.S. federal agencies (and a strong prioritization signal for everyone else).	CVE-2026-85706 is in KEV as of 2026-09-11 with a 2026-09-14 due date. Treat it as exploited and prioritize accordingly.
CVSS	Theoretical severity of the vulnerability based on exploitability and impact characteristics.	Not provided in the source intel for this CVE. Do not infer a score — rely on KEV status and vendor guidance for prioritization.
EPSS	Probabilistic likelihood that the vulnerability will be exploited in the next 30 days.	Not provided in the source intel for this CVE. KEV membership already supersedes EPSS as a prioritization trigger here.

Bottom line for triage: KEV membership is the decisive signal. You do not need a CVSS or EPSS number to justify emergency change approval — CISA has already confirmed exploitation and set a three-day remediation window.

Step-by-step remediation

1. Inventory. Enumerate every GitLab Community Edition and Enterprise Edition instance in your environment, including self-managed deployments, cloud-hosted instances, and any shadow IT or developer-run instances. Record version, hosting model, and network exposure (internet-facing vs. internal-only).
2. Assess exposure. For each instance, determine whether the repository commits API is reachable from untrusted networks. Per CISA's guidance, stakeholders are responsible for evaluating each asset's internet exposure. Internet-facing instances should be treated as the highest priority.
3. Patch or mitigate. Apply the vendor's patch release in accordance with GitLab's instructions (see the patch release notes in Related resources). If a patch cannot be applied immediately, apply the vendor-documented mitigations, restrict network access to the affected API, or — per CISA's required action — discontinue use of the product if mitigations are unavailable.
4. Verify. After patching, confirm the running version matches the fixed release, re-test that the repository commits API is no longer reachable in an unauthenticated context from untrusted networks, and validate that no unauthorized file reads occurred during the exposure window.
5. Follow BOD 26-04 and forensics triage. Align remediation and any forensic triage activities with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk and the associated Forensics Triage Requirements implementation guidance.
6. Close the ticket. Document the version before and after, the patch timestamp, the exposure assessment, and the verification evidence. Close the KEV item only after verification is complete and evidence is attached.

FAQ

Is CVE-2026-85706 in CISA KEV? Yes. CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities catalog on 2026-09-11.

What is the CISA due date for CVE-2026-85706? The CISA due date is 2026-09-14. That is a three-day window from the KEV addition date, so change management should be pre-authorized for this patch.

Is this vulnerability internet-facing / remotely exploitable? The vulnerability allows an unauthenticated user to read arbitrary files via the repository commits API. Any GitLab CE/EE instance whose repository commits API is reachable from an untrusted network should be considered exposed. CISA explicitly directs stakeholders to evaluate each asset's internet exposure.

Is there a known ransomware tie? The source intel lists known ransomware use as Unknown for this CVE. Absence of a confirmed ransomware association does not lower the priority — KEV membership alone warrants emergency remediation.

What is the weakness type? CWE-35, Path Traversal, caused by improper path confinement and missing authentication enforcement in the repository commits API.

What if I can't patch before the due date? Apply vendor-documented mitigations, restrict access to the affected API, or — per CISA's required action — discontinue use of the product if mitigations are unavailable. Follow applicable BOD 26-04 guidance for cloud services.

Related resources

• GitLab patch release notes (19.3.2)
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD entry for CVE-2026-85706