Skip to content
Threat Feed
Subscribe
high advisory PoC

Multiple Vulnerabilities in GitLab CE and EE

GitLab has released security patches addressing a large set of vulnerabilities across Community and Enterprise editions, including flaws leading to remote code execution and data confidentiality compromises.

CVE search metadata

CVE search record: CVE-2026-87719. Severity: critical. CVSS: 9.9. EPSS: 0.61%. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-85706. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2024-11222. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2025-14871. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-1168. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-12910. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-13210. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-16794. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-19619. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-3855. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-7514. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-78252. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-79708. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-8030. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-82837. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-86340. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-86341. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

CVE search record: CVE-2026-88765. KEV: no. Product: GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Community Edition (< 19.1.8), GitLab Enterprise Edition, Community Edition (< 19.1.8), Enterprise Edition (< 19.1.8), GitLab Community Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2), GitLab Enterprise Edition (>= 18.7, < 19.1.8, >= 19.2, < 19.2.6, >= 19.3, < 19.3.2). Brief: Multiple Vulnerabilities in GitLab CE and EE. Brief link: https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/

Triage facts

Revision 1
Applicability
GitLab Community Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2), GitLab Enterprise Edition (< 19.1.8, 19.2.x < 19.2.6, 19.3.x < 19.3.2) +6
Evidence
Unknown
Severity
High
Action
Immediate escalation
Sources
7 public sources
Freshness
Revision 1Sep 11, 18:55 UTC
Vulnerabilities
18 CVEs
Source quality
A1Likely

What's new

  • 1. added CVE-2026-87719; Sep 14, 19:10 via socprime
  • 2. new product Sep 12, 00:50 via cisa-kev
  • 3. poc_available Sep 11, 23:36 via sploitus
  • 4. added CVE-2026-85706 Sep 11, 21:27 via cisa

On September 10, 2026, GitLab released critical security patches for its Community Edition (CE) and Enterprise Edition (EE) platforms. The update addresses a significant number of vulnerabilities reported by the CERT-FR in advisory CERTFR-2026-AVI-1160. These vulnerabilities affect GitLab versions prior to 19.1.8, as well as 19.2.x prior to 19.2.6, and 19.3.x prior to 19.3.2.

The disclosed flaws include critical impacts such as remote code execution (RCE), denial-of-service (DoS), security policy bypasses, and unauthorized access to sensitive data. Given the breadth of vulnerabilities - ranging from RCE to cross-site scripting (XSS) - these patches are essential to maintain the integrity of development environments and source code repositories. Defenders should prioritize auditing internet-facing GitLab instances for these versions and applying the security patches immediately to mitigate the risk of exploitation.

Impact

Successful exploitation of these vulnerabilities could result in full system compromise, exfiltration of proprietary source code, internal network reconnaissance, or localized denial-of-service, impacting the development lifecycle and data confidentiality for any organization running affected GitLab versions.

Recommendation

  • Upgrade all instances of GitLab Community Edition and Enterprise Edition to the latest patched versions: 19.1.8, 19.2.6, or 19.3.2 as specified in the official GitLab security release.
  • Review web server access logs for anomalous POST requests or unusual URI patterns targeting common GitLab endpoints, which could indicate exploitation attempts against these CVEs.
  • Patch the following CVEs: CVE-2024-11222, CVE-2025-14871, CVE-2026-1168, CVE-2026-12910, CVE-2026-13210, CVE-2026-16794, CVE-2026-19619, CVE-2026-3855, CVE-2026-7514, CVE-2026-78252, CVE-2026-79708, CVE-2026-8030, CVE-2026-82837, CVE-2026-85706, CVE-2026-86340, CVE-2026-86341, CVE-2026-87719, and CVE-2026-88765.

Immediate actions

Upgrade GitLab instances to versions 19.1.8, 19.2.6, or 19.3.2.

IT Operations 24h

Mitigations

Patch GitLab to 19.1.8, 19.2.6, or 19.3.2.

immediate IT Operations

Multiple CVEs