CISA: Hackers now exploit max severity GitLab flaw in attacks
-
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity GitLab vulnerability to its list of known exploited vulnerabilities, confirming that attackers are actively weaponizing the flaw in the wild.
The vulnerability carries a CVSS score of 10.0, the highest possible severity rating, indicating it can be exploited remotely with no authentication and requires no user interaction. Details on the specific weakness and affected versions are limited in the source report, but the critical takeaway is that exploitation is confirmed and ongoing.
Administrators running GitLab should treat this as urgent. Recommended actions include:
- Apply the latest security patches from GitLab immediately
- Check whether your instance is exposed to the internet and restrict access where possible
- Review logs for signs of exploitation and unusual activity
- Monitor CISA's Known Exploited Vulnerabilities catalog for updates
Given that CISA has flagged this as actively exploited, organizations with internet-facing GitLab deployments should prioritize patching over standard change-control timelines.
Source: BleepingComputer
Is your organization running GitLab, and have you already patched or restricted access in response to this advisory?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login