GitLab disclosed CVE-2026-85706 on September 12, a maximum-severity path traversal vulnerability in its repository commits API that allows unauthenticated attackers to read arbitrary files from the GitLab server by crafting POST requests to the /api/v4/projects/{id}/repository/commits/ endpoint containing manipulated file.path parameters. Exploitation in the wild was confirmed September 13, one day after disclosure. WatchTowr head of threat intelligence Jake Knott stated that mass exploitation is likely to follow shortly, citing the severity, the unauthenticated attack vector, and the scale of internet-exposed self-managed GitLab instances. Security firm CyCognito estimates more than 20,000 self-managed GitLab instances are reachable on standard web ports, with a meaningful share still unpatched days after critical advisories ship. This is the second simultaneous critical GitLab CVE under active attack: CVE-2026-19478, the GraphQL code injection tracked since Issue 114, remains under active exploitation in parallel. GitLab also patched CVE-2026-87719 in the same release, a CVSS 9.9 Duo Chat GraphQL serialization bypass that allows an authenticated user to obtain sensitive credentials and Advanced Search instance configurations.

Wiz published findings confirming that attackers have been actively chaining three JFrog Artifactory vulnerabilities since mid-August 2026 to achieve persistent backdoor access to self-hosted Artifactory instances. The chain uses CVE-2026-42018, an insufficient token validation flaw patched July 27, to extract an anonymous-user token from the Artifactory instance. That token is then used with CVE-2026-42016, a privilege escalation flaw also patched July 27, to elevate the anonymous-user token to administrator-level access. With administrator access established, attackers layer in CVE-2026-82329, the authentication bypass covered in Issue 122, which provides a parallel direct route to administrator tokens. CISA added CVE-2026-42018 and CVE-2026-42016 to its Known Exploited Vulnerabilities catalog as part of the five-CVE batch this week, setting a September 25 remediation deadline. The confirmed objective is persistent backdoor deployment on the Artifactory server itself, not only credential or artifact theft. Wiz observed backdoor installations across multiple compromised self-hosted Artifactory instances between August 15 and September 8.

CISA added five vulnerabilities to the Known Exploited Vulnerabilities catalog last week. CVE-2026-84869 in ConnectWise ScreenConnect is a missing authorization flaw rated CVSS 9.9 that allows an attacker to transfer files and execute them through an active remote session without requiring host confirmation or authorization from the session participant. ConnectWise is the remote access and RMM platform used extensively by MSPs and enterprise IT support teams. The federal remediation deadline is today, September 14. Two MikroTik RouterOS flaws, CVE-2026-67277 (kernel memory disclosure and remote denial-of-service in the bandwidth-test service, CVSS 8.8) and CVE-2026-86060 (privilege escalation via a command argument injection in the SSH login path that grants full administrative access with a crafted username, CVSS 9.2), had federal deadlines of September 13. Both deadlines are now passed. The JFrog additions, CVE-2026-42018 and CVE-2026-42016, are covered in story two above with a September 25 deadline.