GitLab's 'perfect 10' bug was probed within 20 hours of its patch

A maximum-severity path-traversal flaw in self-hosted GitLab is being actively probed within roughly 20 hours of its patch, the second time this year a top-rated GitLab bug was weaponized before defenders finished rolling out the fix.

The bug, CVE-2026-85706, lives in GitLab's repository-commits API and lets an unauthenticated attacker read arbitrary files from a vulnerable server so long as at least one public project exists. It scores CVSS 10.0, the highest possible rating. GitLab shipped the fix on 10 September 2026 in versions 19.3.2, 19.2.6, and 19.1.8, covering self-managed CE/EE installs on the 18.7+ and 19.x trains.

Threat-intel firm watchTowr saw in-the-wild probing from 06:00 UTC on 11 September, about 20 hours after the patch. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day, with a 14 September 2026 remediation deadline for U.S. federal civilian agencies. A companion bug, CVE-2026-87719 (CVSS 9.9, an insecure-deserialization flaw in GitLab EE's Duo Chat Advanced Search), shipped in the same release.

The hunting lead, per watchTowr: HTTP POST requests to /api/v4/projects/{id}/repository/commits/ carrying a file.Path parameter. The pattern echoes CVE-2026-19478, a max-severity GraphQL injection GitLab patched earlier in the year. For self-hosted admins, the next 72 hours are the working window: confirm version, patch, hunt for the named IOCs, and segment internet-facing instances.