Our automated tracking framework flagged that CISA added CVE-2026-85706 (GitLab Community Edition and Enterprise Edition) to the Known Exploited Vulnerabilities (KEV) catalog on September 12, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-85706 by September 14, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-85706 |
| Vendor / product | GitLab Community Edition and Enterprise Edition |
| Vulnerability | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability |
| CVSS base score | 10 |
| Added to KEV | September 11, 2026 |
| Days public before listing (NVD → KEV lag) | -1 |
| Federal patch deadline | September 14, 2026 |
| Known ransomware use | No |
How This Compares to GitLab’s Track Record
This one was listed on or before its public disclosure (a lag of -1 days) — a zero-day exploited at or before the vulnerability was even published. GitLab currently ranks #25 on our KEV Lag leaderboard.
| GitLab in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 5 |
| Median lag (public → KEV listing) | 194 days |
| 0-day rate (exploited at or before disclosure) | 20% |
| Entries tied to known ransomware campaigns | 1 |
For perspective, the median across all 1709 tracked KEV entries is 252 days — GitLab’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent GitLab KEV Additions
The most recent GitLab vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2021-22175 | GitLab | February 18, 2026 | 1713 | No |
| CVE-2021-39935 | Community and Enterprise Editions | February 3, 2026 | 1513 | No |
| CVE-2023-7028 | GitLab CE/EE | May 1, 2024 | 110 | No |
| CVE-2021-22205 | Community and Enterprise Editions | November 3, 2021 | 194 | ⚠️ Yes |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-85706, a critical path traversal vulnerability affecting GitLab Community Edition and Enterprise Edition, to its Known Exploited Vulnerabilities (KEV) catalog. It has a CVSS base score of 10. The federal patch deadline is September 14, 2026. Organizations using GitLab should patch before this deadline. If you can’t, restrict access to GitLab installations and implement enhanced monitoring.
This CVE was added to KEV on September 11, 2026, with a ‘days public before KEV listing’ value of -1. This suggests it was being exploited as a zero-day. It gives defenders very little time to detect and respond. While ransomware use isn’t currently known, the immediate exploitation signifies a high probability of malicious activity already underway.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
