CISA Adds CVE-2026-85706 GitLab Path Traversal to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on September 11, 2026. The entry, CVE-2026-85706, affects GitLab Community Edition and GitLab Enterprise Edition. The vulnerability is classified as a path traversal issue. CISA stated there is evidence of active exploitation, though specific technical details of the exploitation activity were not disclosed in the advisory.

Path traversal vulnerabilities are a frequent attack vector for malicious cyber actors. Successful exploitation could allow attackers to access sensitive files or gain further access to the affected system. Under Binding Operational Directive (BOD) 26-04, FCEB agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation. The directive also establishes expectations for agencies to check whether threat actors had already compromised systems before patches were applied.

CISA encouraged all organizations, not just federal agencies, to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities. The agency noted it will continue to add vulnerabilities to the catalog that meet the specified criteria of evidence of active exploitation.