Short answer: Over 1,000 GitLab servers are at risk of remote code execution. Users should update to the latest versions immediately.
TL;DR
- Over 1,000 GitLab servers are vulnerable.
- Update to the latest versions.
- This allows attackers to run code on the server.
- Immediate action is needed to secure servers.
What is CVE-2026-0723?
GitLab servers have a critical flaw that lets attackers run any code on them. This can steal data or take control of the server. Users need to update to the latest version to fix this issue. Over 1,000 servers are at risk. Updating is the only way to protect them.
- RCE (remote code execution)
- An attacker can run their own commands on someone else's computer or server over the internet.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Patch
- A software update from the maker that fixes a security weakness.
Key facts
| Reported by | BleepingComputer |
|---|---|
| Date reported | 02 Nov 2026 |
| CVE | CVE-2026-0723 |
| CVSS | 7.4 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| Weakness | CWE-252 (see NVD) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Vendor advisory | about.gitlab.com |
| CVE | CVE-2026-110264 |
| CVSS | 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Weakness | CWE-190 (see NVD) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Vendor advisory | docs.gitlab.com |
| CVE | CVE-2026-85706 |
| CVSS | 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
| Weakness | CWE-22 (path traversal) |
| CISA KEV | Yes, added 2026-09-11; federal due date 2026-09-14 |
| Ransomware use | Unknown (CISA KEV) |
| Affected product | GitLab Community Edition and Enterprise Edition |
| Fixed versions | 18.6.4, 18.7 (CVE-2026-0723, per NVD) |
| Fixed versions | 18.11.13, 19.0 (CVE-2026-110264, per NVD) |
| Fixed versions | 18.11.12, 19.0 (CVE-2026-85706, per NVD) |
| Published in NVD | 2026-01-22 (CVE-2026-0723) |
| Published in NVD | 2026-10-22 (CVE-2026-110264) |
| Published in NVD | 2026-09-12 (CVE-2026-85706) |
How it works
A specially crafted regular expression could cause an integer overflow, allowing an attacker to run code on the GitLab server. GitLab versions from 7.0 to 19.5 before specific patches were vulnerable.
- Attacker reaches the target over the internet
- No login or account is needed
- Sends crafted input that triggers the flaw
- Impact: data can be read, data or code can be changed
Skillmate analyst mapping (our judgement, not from the vendor):
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-01-22 | CVE-2026-0723 published in NVD | NVD |
| 2026-09-11 | CVE-2026-85706 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-09-12 | CVE-2026-85706 published in NVD | NVD |
| 2026-09-14 | US federal agencies must patch by this date | CISA KEV |
| 2026-10-22 | CVE-2026-110264 published in NVD | NVD |
| 2026-11-02 | Reported by BleepingComputer | BleepingComputer |
| 2026-11-03 | This Skillmate explainer published | Skillmate |
How to fix it
- Update GitLab Community Edition and Enterprise Edition now. NVD lists the fixed versions as 18.6.4, 18.7; 18.11.13, 19.0; 18.11.12, 19.0.
- Read the vendor advisory for CVE-2026-0723 and upgrade to the fixed release it lists.
- Read the vendor advisory for CVE-2026-110264 and upgrade to the fixed release it lists.
- CVE-2026-85706 is in CISA KEV: treat it as actively exploited and patch first.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-0723 is a real NVD record scored 7.4 HIGH | CISA KEV does not list CVE-2026-0723 as exploited in the wild |
| CVE-2026-110264 is a real NVD record scored 10.0 CRITICAL | CISA KEV does not list CVE-2026-110264 as exploited in the wild |
| CVE-2026-85706 is a real NVD record scored 10.0 CRITICAL | NVD links no vendor advisory for CVE-2026-85706 yet |
| CISA lists CVE-2026-85706 as exploited in the wild | |
| NVD lists fixed versions for CVE-2026-0723: 18.6.4, 18.7 | |
| NVD lists fixed versions for CVE-2026-110264: 18.11.13, 19.0 | |
| NVD lists fixed versions for CVE-2026-85706: 18.11.12, 19.0 | |
| Reported by BleepingComputer | |
| Reported by about.gitlab.com | |
| Reported by docs.gitlab.com |
Why it matters
This affects over 1,000 GitLab servers, posing a serious risk of unauthorized code execution. Companies and users must upgrade to patched versions to prevent attacks.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
Related Skillmate posts
Sources
- Over 1,000 GitLab servers vulnerable to ongoing RCE attacks (BleepingComputer)
- Vendor advisory CVE-2026-0723 (about.gitlab.com)
- Vendor advisory CVE-2026-110264 (docs.gitlab.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
