[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQH_2xRjfsXrrMNx4TDVAFFUR1wBTNgCkhm9MaqQHtJw":3,"$fIe9lzEtdOAhKiJCblR-lmEPtzDxcSF0rN4DNiIrGxlY":71},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":68,"created_at":69,"updated_at":70,"published_at":49},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004 Exploited: diffpatch API Abused to Run Shell Commands","The critical flaw lets any user with repository write access install a Git hook and run commands as the Gitea service account; with open self-registration, that can be an unauthenticated visitor.","CVE-2026-60004 is a critical remote code execution flaw in Gitea's diffpatch API, fixed in Gitea 1.27.1 on 27 July 2026. An attacker with repository write access, which open self-registration lets anyone obtain, can install a Git hook and run commands as the Gitea service account. CISA added it to its KEV catalogue on 25 August 2026 after reports of miner-like payloads on unpatched servers.",[10,11,12,13,14,15],"Gitea","CVE-2026-60004","RCE","diffpatch","Git hooks","CVSS 9.8","# Gitea RCE CVE-2026-60004 Exploited: diffpatch API Abused to Run Shell Commands\n\n*The critical flaw lets any user with repository write access install a Git hook and run commands as the Gitea service account; with open self-registration, that can be an unauthenticated visitor.*\n\n**Tags:** `Gitea` `CVE-2026-60004` `RCE` `diffpatch` `Git hooks` `CISA KEV`\n\n> CVE-2026-60004 is a critical remote code execution flaw in Gitea's diffpatch API, fixed in Gitea 1.27.1 on 27 July 2026. An attacker with repository write access, which open self-registration lets anyone obtain, can install a Git hook and run commands as the Gitea service account. CISA added it to its KEV catalogue on 25 August 2026 after reports of miner-like payloads on unpatched servers.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | Affected versions | Fixed in | CISA KEV |\n|---|---|---|---|---|\n| CVE-2026-60004 | 9.8 | Gitea 1.17 to 1.27.0 | 1.27.1 | Added 25 August 2026 |\n\n## Gitea RCE through the diffpatch API\n\nCVE-2026-60004 is a code injection flaw in Gitea's diffpatch API endpoint, which applies user-supplied patches. An attacker with ordinary write access to a repository can submit repository-controlled content that installs a Git hook, which then runs arbitrary shell commands as the Gitea service account during Git operations. runZero rates it critical with a CVSS score of 9.8 and lists Gitea 1.17 through 1.27.0 as affected.\n\nSelf-registration is enabled by default. Gitea's advisory, as quoted by Help Net Security and BleepingComputer, notes that with open registration an unauthenticated visitor can obtain the required write access by registering an account and creating a repository. Successful exploitation gives code execution with the privileges of the Gitea process, which runZero says could expose system secrets and credentials and affect downstream build pipelines.\n\nThe vulnerability was discovered and reported by security researcher Shai Rod (NightRang3r). Gitea released version 1.27.1 with the fix on 27 July 2026, followed by its security advisory on 28 July. Help Net Security notes that 1.27.2 was the latest release at the time of its report.\n\n## Active exploitation\n\nCISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalogue on 25 August 2026 and gave US federal civilian agencies until 28 August to patch. CISA did not share details of the attacks.\n\nHelp Net Security reports that a self-described full-stack developer published an incident report on the Russian blog Habr after their hosting provider flagged high CPU usage on a virtual server running an outdated Gitea version with open registration. The attacker first wrote a proof of code execution into a Git branch, then downloaded a universal shell loader and a crypto-miner-like dropper. According to SOC Prime, the dropper tried to terminate competing CPU-heavy processes, downloaded a payload matching the host architecture, ran it and deleted the file. No persistence via cron, systemd or new SSH keys was found.\n\n## Exposure\n\nBleepingComputer reported on 26 August that Shadowserver was tracking nearly 5,000 internet-exposed Gitea instances, with no information on how many were honeypots or already patched. CosmicBytez Labs later reported, citing Shadowserver, more than 8,300 exposed instances unpatched against CVE-2026-60004; we have not been able to confirm that figure against Shadowserver's own data.\n\n## Remediation\n\nUpgrade to Gitea 1.27.1 or later; Help Net Security recommends the latest release. If open sign-up is not needed, disable self-registration, which removes the lowest-effort route to the write access the attack requires, and limit internet exposure of self-hosted instances.\n\nA separate flaw, CVE-2026-59774, also affects Gitea. NVD describes it as a file read through the Org-mode renderer's INCLUDE directive that an unauthenticated attacker can trigger via a suitable public repository; if the disclosed files include `app.ini` and its `INTERNAL_TOKEN`, it can be chained to modify a Git hook and execute commands.\n\n## Key points\n\n- CVE-2026-60004 lets a user with repository write access install a Git hook through Gitea's diffpatch API and run commands as the Gitea service account.\n- Open self-registration, enabled by default, lets an unauthenticated visitor gain that write access.\n- Gitea 1.17 through 1.27.0 are affected; 1.27.1, released 27 July 2026, fixes it.\n- CISA added the flaw to KEV on 25 August 2026; reported attacks dropped miner-like payloads.\n- Shadowserver tracked nearly 5,000 exposed Gitea instances in late August; a later figure of over 8,300 is unconfirmed.\n\n## Further reading & sources\n\n- [Gitea vulnerability CVE-2026-60004: find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fgitea) — runZero\n- [Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F08\u002F26\u002Fgitea-cve-2026-60004-exploited-in-the-wild) — Help Net Security\n- [Hackers now exploit critical Gitea flaw in code injection attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks\u002F) — BleepingComputer\n- [CVE-2026-60004: Critical Gitea RCE Exploited to Deploy Miner-Like Payloads](https:\u002F\u002Fsocprime.com\u002Fblog\u002Fcve-2026-60004-critical-gitea-rce-exploited-to-deploy-miner-like-payloads) — SOC Prime\n- [Over 8,300 Gitea Servers Still Vulnerable to Active Code Execution Attacks](https:\u002F\u002Flabs.cosmicbytez.ca\u002Fnews\u002F2026-08-28-over-8300-gitea-servers-vulnerable-to-code-execution-attacks) — CosmicBytez Labs","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81",{"cves":19,"malware":35,"targets":44,"timeline":52,"industries":61,"technologies":66},[20,29],{"id":21,"kev":22,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2026-59774",false,"\u002Fvulnerabilities\u002FCVE-2026-59774",9.8,0.2831,"Medium",55.79,"3.1",{"id":11,"kev":30,"poc":22,"url":31,"cvss":24,"epss":32,"risk_band":33,"risk_score":34,"cvss_version":28},true,"\u002Fvulnerabilities\u002FCVE-2026-60004",0.2399,"Critical",89.63,[36,38,40,42],{"name":37},"Dropper",{"name":39},"shell-loader",{"name":41},"crypto-miner",{"name":43},"crypto-miner-like dropper",[45,50],{"name":46,"sector":47,"status":48,"geography":49},"HOSTKEY","hosting","confirmed",null,{"name":10,"sector":51,"status":48,"geography":49},"DevOps",[53,57],{"date":54,"event":55,"description":56},"2026-07-27","Patch release","Gitea released version 1.27.1",{"date":58,"event":59,"description":60},"2026-08-26","CISA KEV addition","CISA added CVE-2026-60004 to KEV catalog",[62],{"url":63,"name":64,"slug":65},"\u002Findustries\u002Fcloud-hosting","Cloud & Hosting","cloud-hosting",[67],{"vendor":10,"product":10},"vulnerability_disclosure","2026-09-12T12:07:21.883073+00:00","2026-10-16T12:28:42.390191+00:00",{"articles":72},[73,84,95,105],{"slug":74,"title":75,"summary":76,"tags":77,"hero_image_url":82,"story_type":68,"created_at":83},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-able N-central auth bypass CVE-2026-18556 with 3-day federal deadline","CISA added CVE-2026-18556, an authentication bypass in N-able N-central that allows unauthenticated administrative account takeover in versions through 2026.1, to its Known Exploited Vulnerabilities catalog on 4 August 2026, with a 7 August deadline for US federal civilian agencies.",[78,79,80,12,81],"CVE-2026-18556","N-Able N-Central","CISA KEV","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00",{"slug":85,"title":86,"summary":87,"tags":88,"hero_image_url":92,"story_type":93,"created_at":94},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found at least 274 internet-facing Zimbra Collaboration Suite servers compromised via CVE-2026-73570, an unauthenticated OS command injection that affects servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and lets attackers run commands as the zimbra user via crafted SMTP requests.",[89,90,12,80,91],"Zimbra","CVE-2026-73570","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","exploitation","2026-09-24T07:12:41.74195+00:00",{"slug":96,"title":97,"summary":98,"tags":99,"hero_image_url":103,"story_type":93,"created_at":104},"active-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago","Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago","A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.",[100,101,12,102],"SAP","Commerce Cloud","Retail","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Factive-attacks-target-max-severity-sap-commerce-cloud-rce-patched-three-days-ago.png?v=1fb0e11c19","2026-08-14T15:55:48.267776+00:00",{"slug":106,"title":107,"summary":108,"tags":109,"hero_image_url":115,"story_type":68,"created_at":116},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[110,111,112,113,80,114],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a","2026-10-17T12:03:14.799873+00:00"]