On August 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60004, a code injection vulnerability in Gitea, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition is based on evidence of active exploitation in the wild. The vulnerability affects Gitea software and poses significant risks to federal enterprise environments, particularly on publicly exposed assets. CISA's Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control post-exploitation.

What should defenders do?

Organizations using Gitea should apply security updates promptly to mitigate CVE-2026-60004. Per BOD 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and check for threat actor compromise before patching. All organizations are encouraged to adopt risk-based vulnerability management practices and monitor CISA and Gitea advisories for patch availability and exploitation updates.

highSecurity Advisories

CISA Adds CVE-2026-60004 Gitea Code Injection Vulnerability to Known Exploited Catalog

New KEV entry highlights active exploitation risk for Gitea instances; BOD 26-04 mandates rapid remediation for federal agencies

CyberIntel DeskPublished 24 days agoUpdated less than a minute ago1 min read

Key Takeaways

CISA added CVE-2026-60004, a Gitea code injection vulnerability, to the KEV Catalog on August 25, 2026, based on evidence of active exploitation.
The vulnerability poses significant risks to federal enterprise environments and other organizations using Gitea on publicly exposed assets.
Binding Operational Directive (BOD) 26-04 requires FCEB agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and to check for prior compromise before patching.

Related Security News

highVulnerability

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.

The Hacker Newsabout 4 hours ago1 min read

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read