CISA warned that hackers are actively exploiting a maximum-severity GitLab vulnerability (CVE-2026-85706) that allows unauthenticated attackers to read credentials and sensitive data. GitLab released patches on Thursday, and CISA added the flaw to its catalog of exploited vulnerabilities, requiring federal agencies to patch within three days.
GitLab urged users to immediately patch a maximum-severity path traversal vulnerability (CVE-2026-85706) in its repository commits API that allows unauthenticated attackers to read arbitrary data from vulnerable servers. Cybersecurity firm watchTowr reported that attackers are already probing for unpatched GitLab instances. The company also patched a second critical deserialization vulnerability (CVE-2026-87719) affecting GitLab Enterprise Edition.
Google patched 230 vulnerabilities including CVE-2026-87491, a seventh actively exploited Chrome zero-day this year stemming from an out-of-bounds write in the V8 engine. The high-severity flaw allows remote attackers to execute arbitrary code via crafted HTML pages. Updates rolled out to Windows, Mac, and Linux systems and should reach most users within days or weeks.