# GitLab vulnerabilities & exploitation **CISA KEV** · **Ransomware** > As of 2026-10-05, Threadlinqs tracks 8 GitLab CVEs, 4 in the CISA Known Exploited Vulnerabilities catalog, 1 used in ransomware campaigns, linked to 14 tracked threat campaigns and 2 named threat actors. **Data as of:** 2026-10-05 ## Exploitation timeline Threadlinqs has recorded 8 GitLab CVEs published between 2021-04-15 and 2026-09-15. The busiest month was 2026-08 (2 new CVEs). 4 of them (50%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 8 of 8 tracked GitLab CVEs. - [CVE-2021-22205](https://intel.threadlinqs.com/cve/CVE-2021-22205) — CRITICAL 10 · KEV · Ransomware · EPSS 94.5% · 2021-04-23 - [CVE-2023-7028](https://intel.threadlinqs.com/cve/CVE-2023-7028) — CRITICAL 9.8 · KEV · EPSS 93.3% · 2024-01-12 - [CVE-2021-39935](https://intel.threadlinqs.com/cve/CVE-2021-39935) — MEDIUM 6.8 · KEV · EPSS 41.4% · 2021-12-13 - [CVE-2026-85706](https://intel.threadlinqs.com/cve/CVE-2026-85706) — CRITICAL 10 · KEV · EPSS 1.1% · 2026-09-12 - [CVE-2026-87719](https://intel.threadlinqs.com/cve/CVE-2026-87719) — CRITICAL 9.9 · EPSS 0.6% · 2026-09-12 - [CVE-2026-6267](https://intel.threadlinqs.com/cve/CVE-2026-6267) — HIGH 8.5 · EPSS 0.3% · 2026-07-29 - [CVE-2026-19478](https://intel.threadlinqs.com/cve/CVE-2026-19478) — CRITICAL 9.4 · 2026-08-17 - [CVE-2026-19650](https://intel.threadlinqs.com/cve/CVE-2026-19650) — HIGH 7.1 · 2026-08-17 ## Products affected Threadlinqs normalises CPE and CNA product records across all 8 CVEs; 1 distinct GitLab product is affected. The most frequently affected: - Gitlab — 8 CVEs ## Threat activity 14 tracked threat campaigns reference GitLab products or exploit GitLab CVEs: - [GitLab AI Gateway critical RCE via prompt template sandbox escape (CVE-2026-90970)](https://intel.threadlinqs.com/threat/TL-2026-2846) — CRITICAL — 2026-10-02 - [The Infostealer Incursion: Stolen Credentials Breach Cloud, Code, and AI Environments](https://intel.threadlinqs.com/threat/TL-2026-2687) — HIGH — 2026-09-27 - [GitLab Patches Max-Severity Unauthenticated Path Traversal Flaw in Repository Commits API (CVE-2026-85706, CVSS 10.0)](https://intel.threadlinqs.com/threat/TL-2026-2442) — CRITICAL — 2026-09-11 - [Critical GitLab GraphQL Flaw (CVE-2026-19478, CVSS 9.4) Could Let Unauthenticated Attackers Delete Public Projects](https://intel.threadlinqs.com/threat/TL-2026-2048) — CRITICAL — 2026-08-17 - [Microsoft shortens NuGet.org API key lifetimes to 30 days for supply-chain hardening (effective Aug 17, 2026)](https://intel.threadlinqs.com/threat/TL-2026-1876) — MEDIUM — 2026-08-04 - [Alleged Żabka Polska Breach: 541K Jira Issues, 230K IT Tickets, 89 GitLab Repos, and Cloudflare/MongoDB/Broker Credentials Offered for €5,000](https://intel.threadlinqs.com/threat/TL-2026-1834) — HIGH — 2026-08-03 - [GitLab Patches 13 Security Flaws (incl. CVE-2026-6267, CVE-2026-12436) Enabling Data Exposure, CI/CD Tampering, and DoS](https://intel.threadlinqs.com/threat/TL-2026-1806) — HIGH — 2026-07-29 - [GitLab RCE Chain via Malicious Jupyter Notebooks Exploiting Oj Ruby JSON Parser Flaws](https://intel.threadlinqs.com/threat/TL-2026-1715) — CRITICAL — 2026-07-27 - [GitLab RCE via Chained Oj JSON Parser Memory-Safety Flaws (Code Execution as 'git' User)](https://intel.threadlinqs.com/threat/TL-2026-1691) — HIGH — 2026-07-25 - [MetaChat Brand Impersonation Phishing Campaign Targets AI API Keys and Credentials via EdgeOne Pages](https://intel.threadlinqs.com/threat/TL-2026-1522) — HIGH — 2026-07-19 - [Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day Exploits (CVE-2021-22205, CVE-2021-35394) and Telnet/SSH Brute-Force, Later Adding Ransom DDoS](https://intel.threadlinqs.com/threat/TL-2026-0754) — HIGH — 2026-06-10 - [GitLab CE/EE Security Patch Release (19.0.1 / 18.11.4 / 18.10.7) — CVE-2026-4868 GitLab Duo AI Workflow Runner Identity Confusion (CVSS 8.2) Plus DoS and Broken-Authorization Flaws](https://intel.threadlinqs.com/threat/TL-2026-0634) — HIGH — 2026-05-30 - [APT35 (Charming Kitten) GCC Pre-Positioning Cyber Reconnaissance Campaign Enabling Kinetic Targeting](https://intel.threadlinqs.com/threat/TL-2026-0339) — CRITICAL — 2026-04-09 - [GitLab CI Lint API SSRF — CVE-2021-39935 Patch Bypass, CISA KEV Feb 2026, Cloud Metadata Theft, Internal Service Enumeration, 4-Year Exploitation Gap on Self-Managed Instances](https://intel.threadlinqs.com/threat/TL-2026-0089) — HIGH — 2026-02-03 ## Threat actors targeting GitLab Named threat actors attributed to campaigns that involve GitLab products or CVEs, with the number of linked campaigns: - [APT35](https://intel.threadlinqs.com/actor/APT35) — 1 campaign - [APT42](https://intel.threadlinqs.com/actor/APT42) — 1 campaign ## How to prioritise GitLab patching This order follows the data Threadlinqs holds for GitLab, not a generic severity checklist: - 4 of 8 GitLab CVEs (50%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2021-22205](https://intel.threadlinqs.com/cve/CVE-2021-22205), [CVE-2023-7028](https://intel.threadlinqs.com/cve/CVE-2023-7028), [CVE-2021-39935](https://intel.threadlinqs.com/cve/CVE-2021-39935). - 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems. - Outside KEV, the highest EPSS scores are [CVE-2026-87719](https://intel.threadlinqs.com/cve/CVE-2026-87719) (0.6%), [CVE-2026-6267](https://intel.threadlinqs.com/cve/CVE-2026-6267) (0.3%). - 5 CVEs score Critical and 2 High on CVSS v3 (maximum 10, average 8.9); sequence these after KEV and high-EPSS items. - 2 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/gitlab All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp