GoKawiilAttackers Actively Exploiting Critical GitLab Path Traversal Bug, CVE-2026-85706
A maximum-severity flaw in GitLab's Community and Enterprise editions, patched September 10, is being actively exploited to pull arbitrary files from self-hosted GitLab servers without authentication. WatchTowr researchers say attackers have moved from probing to full exploitation, extracting configuration files, secrets, and SSH settings from compromised systems. CISA has added the bug to its Known Exploited Vulnerabilities list, ordering federal agencies to patch or take affected instances offline.