CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-85706)
CISA added CVE-2026-85706, a GitLab path traversal vulnerability under active exploitation, to its Known Exploited Vulnerabilities Catalog. GitLab Community and Enterprise Editions contain a path traversal vulnerability (CVE-2026-85706) being actively exploited in the wild. CISA added it to the KEV Catalog, requiring FCEB agencies to remediate under BOD 26-04. All organizations should patch exposed GitLab instances.
Detection / Hunteropenrouter
Immediate Actions
- Patch GitLab to the latest fixed version immediately.
- Restrict external access to GitLab instances until patched.
- Audit GitLab logs for evidence of path traversal exploitation.
Key Takeaways
- CVE-2026-85706 affects GitLab Community Edition and Enterprise Edition.
- Vulnerability type is path traversal, a frequent attacker vector.
- BOD 26-04 requires FCEB agencies to remediate KEV-listed CVEs on exposed assets.
- CISA confirms active exploitation evidence prompted the KEV addition.
- Agencies must check for prior compromise before applying patches.
Attack Chain
- Initial Access: Attacker exploits path traversal in exposed GitLab instance
- Exploitation: CVE-2026-85706 allows unauthorized file access via path manipulation
- Persistence: Attacker may establish foothold post-exploitation
- Actions on Objectives: Attacker accesses sensitive files and data
Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
- FCEB agency public-facing assets
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition | Path traversal vulnerability actively exploited in the wild. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Path traversal in a web application may not generate EDR telemetry on the server. |
| Network Visibility | Medium | Unusual HTTP requests to GitLab may be visible in WAF or reverse proxy logs. |
| Detection Difficulty | Moderate | Path traversal patterns in HTTP requests require log analysis; no signatures published. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for HTTP requests to GitLab containing path traversal sequences like ../ or encoded variants (T1190). | WAF or reverse proxy HTTP request logs | Initial Access | Medium — legitimate file browsing may use similar patterns |
Required Log Sources
- GitLab application logs
- WAF logs
- Reverse proxy logs
- Web server access logs
Key Behavioral Indicators
- HTTP requests to GitLab containing ../ or URL-encoded traversal sequences
- Unexpected file access patterns in GitLab application logs
- GitLab process accessing files outside expected directories
Control Gaps
- WAF rules may not detect encoded path traversal sequences
- GitLab application logging may not capture malicious file access attempts
False Positive Assessment
Medium — Path traversal detection patterns may overlap with legitimate GitLab file browsing or API usage.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Deploy WAF rules to block path traversal patterns targeting GitLab.
- Place GitLab behind a reverse proxy with request filtering.
- Enforce network segmentation to limit GitLab server access.
User Protection
- Ensure GitLab instances are not unnecessarily exposed to the internet.
- Monitor for unauthorized file access on GitLab servers.
MITRE ATT&CK Mapping
Initial Access
Exfiltration
Plain-Language Summary
CISA added a new security flaw in GitLab software to its list of known exploited vulnerabilities. The flaw lets attackers access files they should not reach by manipulating file paths. Federal agencies must fix this on their public-facing systems and check if attackers already got in. All organizations running GitLab should patch it.
- cveCVE-2026-85706Path traversal vulnerability actively exploited in the wild.