CISA: Active Exploitation of Gitea RCE CVE-2026-60004

The Cybersecurity and Infrastructure Security Agency warned that CVE-2026-60004, a remote code execution vulnerability in the open-source Gitea platform, is being exploited after a fix was issued in late July in version 1.27.1. The agency added the flaw to its Known Exploited Vulnerabilities catalog and directed federal civilian agencies to apply the vendor patch by Aug. 28.

Gitea is a self-hosted Git hosting and collaboration platform that includes code review and CI/CD features. CISA described CVE-2026-60004 as a code injection flaw that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint, plant an executable Git hook and run shell commands as the Gitea service account. Those actions can enable execution of commands on the server hosting the service.

The agency reported confirmed exploitations occurring after the patch became available. Public information does not identify the actors or their motives.

In early July, security teams reported active abuse of a separate Gitea vulnerability, CVE-2026-20896; that earlier flaw has been observed in attacks but has not been added to CISA’s KEV catalog.

Administrators of self-hosted Gitea instances should upgrade to version 1.27.1 or later. If signs of compromise appear, incident response steps include reviewing repository access controls, auditing recent commits and patches for unexpected changes, inspecting repository hooks for unknown executable files, and checking server logs and process activity for evidence of the service account running unauthorized commands.

CISA’s KEV listing creates a mandatory remediation timeline for federal agencies. Organizations outside the federal government are not subject to the deadline but are advised to install the vendor patch promptly to reduce exposure.