What is the Vulnerability? FortiGuard Labs has observed attack activity targeting CVE-2026-85706, a critical path traversal vulnerability in GitLab Community Edition and Enterprise Edition. The vulnerability affects the repository commits API and can allow an unauthenticated remote attacker to read arbitrary files from a vulnerable GitLab server due to improper path confinement and missing authentication enforcement. The vulnerability carries a CVSS score of 10.0 and requires no privileges or user interaction. FortiGuard telemetry observed over the last 7 days shows attack activity targeting CVE-2026-85706 across multiple countries and industries. The most targeted countries include Belarus, South Korea, Germany, the People’s Republic of China, and Thailand, while the most targeted industries include Education, Technology, Telco/Carrier, Media/Communications, and Banking/Finance/Insurance. What is the recommended Mitigation? Affected versions include: GitLab 18.7 to before 19.1.8 GitLab 19.2 to before 19.2.6 GitLab 19.3 to before 19.3.2 • Upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or later, as applicable. • Prioritize externally exposed GitLab instances for remediation. • Restrict unnecessary Internet exposure of GitLab services. • Review GitLab and web-server logs for unexpected requests to repository/API endpoints. • Investigate potentially exposed credentials, configuration files, tokens, and other sensitive information if exploitation is suspected. • Rotate credentials or secrets that may have been accessible from the GitLab server. What FortiGuard Coverage is available? • FortiGuard IPS Service: FortiGuard IPS signature 62167 detects and blocks network-based exploitation attempts targeting CVE-2026-85706. Intrusion Prevention | FortiGuard Labs • FortiGate: Offers IPS protection to help prevent exploitation attempts against vulnerable GitLab deployments. • FortiGuard Vulnerability Management: Helps identify vulnerable assets and prioritize remediation based on exposure and risk. • FortiEDR: Offers additional endpoint detection and response capabilities if exploitation leads to suspicious activity on the underlying GitLab server. • FortiGuard Incident Response Service: Assists organizations in investigating potential compromise, determining the scope of attacker activity, and supporting containment, remediation, and recovery efforts following exploitation.