Organizations using Gitea should apply security updates promptly to mitigate CVE-2026-60004. Per BOD 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and check for threat actor compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management practices and monitor CISA and Gitea advisories for patch availability and exploitation updates.
Quick answers
What is CVE-2026-60004?
Organizations using Gitea should apply security updates promptly to mitigate CVE-2026-60004. Per BOD 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and check for threat actor compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management practices and monitor CISA and Gitea advisories for patch availability and exploitation updates.
How severe is CVE-2026-60004?
high
Is CVE-2026-60004 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-60004 be mitigated?
Organizations using Gitea should apply security updates promptly to mitigate CVE-2026-60004. Per BOD 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and check for threat actor compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management practices and monitor CISA and Gitea advisories for patch availability and exploitation updates.
CVSS
—
Vendor
Gitea
Published
Sep 30, 2026 · 08:05
Patch
Unknown / not confirmed
Affected products
Gitea
Mitigation
Organizations using Gitea should apply security updates promptly to mitigate CVE-2026-60004. Per BOD 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and check for threat actor compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management practices and monitor CISA and Gitea advisories for patch availability and exploitation updates.
On August 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60004, a code injection vulnerability in Gitea, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition is based on evidence of active exploitation in the wild. The vulnerability affects Gitea software and poses significant risks to federal enterprise environments, particularly on publicly exposed assets. CISA's Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control post-exploitation.