Rapid7 Tracks Active Exploits Against GitLab Path Traversal

Rapid7’s Exploitation Threat Report for CVE-2026-85706 published September 14, 2026 confirms ongoing active exploitation of the GitLab path traversal flaw. It landed the same day CISA’s federal remediation deadline expired. Unpatched GitLab servers are overdue on both counts.

CVE-2026-85706 is a CVSS 10.0 path traversal in GitLab Community Edition and Enterprise Edition. An unauthenticated remote attacker can use it to read arbitrary files from the server. GitLab shipped the fix in version 19.3.2 on September 11. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, with a remediation deadline of September 14.

0dayNews covered the initial disclosure and KEV listing on September 12. The Rapid7 ETR adds confirmation that attacks against unpatched instances continued through the week following disclosure, past the federal patch deadline.

What the exposure means

A path traversal with no authentication requirement gives an attacker a direct read into server files before they compromise any account or defeat any login control. The GitLab process’s file access is the only constraint on what an attacker can retrieve. Configuration files, secrets, private keys, deploy tokens, and cached credentials on the server filesystem are all accessible.

Rapid7’s telemetry flagged active attempts across their customer base. The full technical analysis is in their ETR.

What to do now

Upgrade to GitLab 19.3.2 or later. The full version matrix is in GitLab’s patch release notes.

If you haven’t patched yet, treat the server as potentially compromised. Review access logs for unusual HTTP requests containing path-traversal strings. Rotate any credentials or secrets stored in files accessible to the GitLab server process, including configuration files, deploy tokens, and SSH keys on the server filesystem. The CVE-2026-85706 entry has the version matrix and advisory link.

The CISA deadline was September 14. Federal agencies are required to have patched by now. Non-federal organizations running self-managed GitLab have no such mandate but face the same attacker pool. The attackers have not carved out an exemption for non-.gov infrastructure.

For context on another network appliance flaw under active exploitation this week, see the Cisco Secure Email Gateway RCE coverage from September 15.