CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Aug 25, 2026
- US federal agencies must remediate it by Aug 28, 2026 (BOD 22-01)
- Attacked 8 days before the vulnerability was made public
- Confirmed by sensors, not only by reports
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Oct 13, 2026 Sep 21, 2026 Sep 13, 2026 Sep 8, 2026 Sep 3, 2026 Aug 26, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| gitea | gitea | < 1.27.1 |
Related articles
One Exploit Operator, Three Technology Stacks and Thousands of Exposed Government Records
Chinese-linked actor exploited WordPress, Zyxel and UniFi flaws to breach government networks, stealing 18,566 records and compromising 996 devices.
Red Heron Exploits Critical Gitea RCE to Breach 13 Organizations
China-linked Red Heron exploited CVE-2026-60004 Gitea RCE to breach 13 orgs, steal repos, harvest credentials and gain root access to internal networks.
Gitea under attack: critical RCE CVE-2026-60004 in KEV catalog, over 8,300 servers exposed
Critical RCE flaw CVE-2026-60004 in Gitea enables remote code execution. 8,300+ servers exposed. Patch to version 1.27.1 now.
An ownCloud flaw allowed theft of Philippine nuclear data: CISA adds it to KEV
On August 27, 2026, CISA added three new vulnerabilities to the Known Exploited Vulnerabilities KEV catalog. The most severe is CVE-2023-49105, an
ZBT: Two New Factory Implants in Chinese Routers Expose Remote Root Access
On August 28, 2026, The Hacker News confirmed through the IEEE registered MAC prefix database that the blocks 78:A3:51 and F8:5E:3C belong to Shenzhen
Gitea Under Attack: Critical RCE Exploited for Cryptojacking, CISA Mandates Patch by August 28
Critical RCE in Gitea (CVE-2026-60004) is being exploited for cryptojacking. CISA requires federal agencies to patch by August 28, 2026.
CISA adds Gitea vulnerability to KEV catalog: exploited to execute code and install miners
On August 25, 2026, the Cybersecurity and Infrastructure Security Agency CISA added vulnerability CVE-2026-60004 to the Known Exploited Vulnerabilities
This product uses the NVD API but is not endorsed or certified by the NVD.