CISA adds Gitea vulnerability to KEV catalog: exploited to execute code and install miners

The KEV addition and the August 28 deadline

On August 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added vulnerability CVE-2026-60004 to the Known Exploited Vulnerabilities (KEV) catalog. The addition is based on evidence of active exploitation.

The remediation deadline for U.S. federal civilian agencies (FCEB) is set for August 28, 2026. This is a three-day window, consistent with operational directive BOD 26-04, which mandates rapid remediation of high-risk vulnerabilities when they allow full control of an exposed asset.

The flaw affects Gitea, an open-source platform for hosting and managing Git repositories, often used as a self-hosted alternative to GitHub or GitLab. CISA classifies it as a code injection vulnerability and indicates it as a frequent attack vector for malicious actors.

How the flaw works: from malicious patch to command execution

The technical description paraphrased from the National Vulnerability Database (NVD) indicates that Gitea contains a code injection vulnerability. An attacker with write access to a repository can submit a malicious patch to the diffpatch API endpoint.

Through this API, it is possible to install an executable Git hook and obtain shell command execution as the Gitea service account. In practice, the attacker does not need to compromise the server directly: they only need to be able to create or modify a repository.

A critical element reported by the security news source SecurityAffairs is that Gitea enables open registration by default. Consequently, an unauthenticated attacker can create an account, create a repository, and exploit the flaw without possessing pre-existing credentials.

Affected versions and fix: the picture remains uncertain

The exact affected versions are not reported in either the CISA advisory or the available NVD record. According to SecurityAffairs, the vulnerability affects Gitea starting from version 1.17 and has been fixed in version 1.27.1.

The version information therefore comes from a single news source. It is not currently confirmed by official Gitea project documentation.

The severity score CVSS 9.8 (critical) is also reported exclusively by SecurityAffairs. The official NVD and CISA excerpts do not include either the CVSS vector or the CWE classification. The described impact, however, is remote code execution as the Gitea service user, consistent with critical severity.

Observed attack: open registration and miner

SecurityAffairs reports an observed attack that exploited the flaw to distribute a payload similar to a cryptocurrency miner. The compromised Gitea instance was exposed on the internet and allowed both open registration and anonymous access to the web interface.

This scenario lowers the entry barrier: the attacker does not need to steal credentials or compromise an existing account. It is enough to reach a vulnerable instance with open registration, create an account and a repository, then submit the malicious patch.

The combination of public exposure, open registration, and a code injection flaw makes the vulnerability particularly suitable for large-scale automated attacks, such as those distributing miners or botnets.

What to do: patch and federal requirements

For organizations using Gitea, the primary mitigation indicated is upgrade to version 1.27.1 or later. Again, the fix version information comes from the sole news source: the official KEV action does not indicate a specific version in the available excerpt, but refers to vendor instructions.

U.S. federal agencies must comply with BOD 26-04: apply vendor mitigations, perform forensic triage checks, and, for cloud services, follow the directive's guidance or cease product use if mitigations are not available.

BOD 26-04 formally applies only to FCEB agencies, but CISA encourages all organizations to adopt risk-based vulnerability management and prioritize CVEs listed in the KEV catalog.

A discrepancy between sources should be noted: SecurityAffairs cites the previous BOD 22-01, while official CISA and NVD sources cite BOD 26-04. The current reference in the CISA advisory is BOD 26-04.

"Reserved" CVE record and discrepancies between sources

Two elements make the information picture still incomplete.

The first concerns the status of the CVE record. At the time of consultation, the CVE Program page (cve.org) shows CVE-2026-60004 as "RESERVED": the ID has been reserved by a CNA and the record should be updated when details become available. This contrasts with the presence of the NVD description and already published KEV data. The CVE record therefore does not provide additional technical details.

The second is an inconsistency in the news source. SecurityAffairs opens the article defining the flaw as a defect in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, but the CVE identifier and all other official sources describe a vulnerability in Gitea. The correct product is Gitea.

These discrepancies do not change the substance: the vulnerability is real, has been actively exploited, and has a very tight federal deadline. Those managing Gitea instances, especially if exposed with open registration, should verify the version in use and apply the update without waiting for confirmation of all technical details.