Critical GitLab Vulnerability Under Active Exploitation Days After Patch Release

How Attackers Are Exploiting the Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that a severe flaw in GitLab, rated as a perfect 10 on the CVSS scale, is being actively exploited in the wild just days after a security patch was made available. The vulnerability, which allows unauthenticated remote code execution on exposed GitLab instances, was identified by security researchers at watchTowr who observed threat actors scanning the internet for vulnerable servers. The flaw affects multiple versions of GitLab Community and Enterprise Editions, prompting urgent warnings from cybersecurity authorities worldwide.

The vulnerability stems from an issue in GitLab’s file upload functionality that could allow attackers to bypass authentication controls and execute arbitrary code on affected systems. watchTowr researchers first detected widespread probing activity targeting internet-facing GitLab installations shortly after the patch was released on September 10, 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 13, confirming that exploitation is underway. The agency urged all organizations using GitLab to apply the latest security updates immediately and to review logs for signs of compromise.

Are Organizations Patching Fast Enough?

Threat actors are leveraging the vulnerability to gain initial access to networks by sending specially crafted requests to unpatched GitLab servers. Once inside, attackers can deploy malware, steal sensitive data, or move laterally within compromised environments. Security analysts note that the ease of exploitation—requiring no user interaction or valid credentials—makes this flaw particularly dangerous. watchTowr reported observing scanning attempts from multiple IP addresses across different geographic regions, suggesting a coordinated effort by cybercriminal groups to capitalize on the window between patch release and widespread adoption.

Despite the availability of fixes, many organizations remain exposed due to delayed update cycles or complex deployment environments. Experts highlight that while large enterprises often have structured patch management, smaller businesses and those using self-hosted GitLab instances may lag in applying updates. CISA emphasized that timely patching remains the most effective defense, recommending that administrators verify their GitLab version and apply the September 10 update without delay. Additional mitigations include restricting network access to GitLab instances and enabling multi-factor authentication where possible.

What versions of GitLab are affected by this vulnerability? The flaw impacts GitLab Community Edition and Enterprise Edition versions prior to 16.5.7, 16.6.4, and 16.7.2, as well as earlier unsupported releases.

Frequently Asked Questions

How can organizations check if their GitLab instance has been compromised? Administrators should review server logs for unusual file upload requests, unexpected admin account activity, or signs of unauthorized file system changes following the patch release date.

Is there a public exploit available for this flaw? While technical details have been disclosed by researchers, no public exploit code has been released at this time, though attackers are actively developing and using their own methods to exploit the vulnerability.