Two CISA KEV-grade vulnerabilities landed over the weekend - one a perfect CVSS 10.0 in GitLab, the other a worm-like RCE tearing through MSP environments via ConnectWise ScreenConnect. Both are being actively exploited. Meanwhile, Revolut’s emergency data request workflow handed customer data to fraudsters using nothing more sophisticated than a hijacked government email account, and JFrog Artifactory exploitation demonstrated exactly how supply chain attacks move from artifact repository to production build.

In the News

GitLab CVSS 10.0 Path Traversal Added to CISA KEV

CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities catalog after confirming active exploitation of a maximum-severity path traversal flaw in self-managed GitLab instances. The vulnerability enables unauthenticated remote code execution - an attacker with network access to the GitLab web interface can traverse the file system, write arbitrary files, and execute code as the GitLab service account.

The severity here is compounded by where GitLab sits in most organizations: at the center of CI/CD pipelines. Compromising the GitLab server does not just give an attacker access to source code - it gives them the ability to inject malicious code into every build that runs through the pipeline. This is the software supply chain attack path that defenders keep warning about, now actively weaponized against a CVSS 10.0 vulnerability with a trivial exploitation path.

Federal agencies are under binding operational directive to patch KEV-listed vulnerabilities on an accelerated timeline. Enterprise organizations running self-managed GitLab should treat this with the same urgency: patch before Monday standups, then audit CI/CD pipeline artifacts for signs of tampering during the exposure window.

What defenders should do: Patch self-managed GitLab immediately. Audit CI/CD pipeline build logs and artifact checksums for the exposure window between vulnerability disclosure and patch application. If GitLab is internet-facing, assume compromise and investigate.

ConnectWise ScreenConnect Worm-Like RCE Hits MSP Environments

ConnectWise shipped an emergency patch for a ScreenConnect vulnerability being exploited in worm-like attacks across MSP environments. The flaw allows unauthenticated file send and execution through active remote sessions - one compromised session automatically propagates to every other session on the same ScreenConnect server without operator interaction.

The blast radius is what makes this critical. ScreenConnect is deployed across thousands of MSPs, each managing dozens to hundreds of SMB customers. A single compromised MSP ScreenConnect server can propagate malicious payloads to every endpoint with an active session. This is the same class of MSP supply chain risk that Kaseya VSA demonstrated in 2021 (MITRE ATT&CK T1072 - Software Deployment Tools), but with worm-like automation that removes the need for manual operator interaction.

The CVE has not yet been formally assigned, but active exploitation is confirmed. ConnectWise released the emergency patch the same day exploitation was reported.

What defenders should do: Apply the ConnectWise emergency patch immediately. Isolate ScreenConnect servers from production networks. Audit all active and recent remote sessions for unexpected file transfers or process execution. If your organization relies on MSPs using ScreenConnect, contact them today and confirm patch status.

Revolut Handed Customer Data to Fraudsters via Hijacked Government Email

Revolut fulfilled emergency data requests submitted through compromised government email accounts, handing customer financial data directly to fraudsters. The attackers did not exploit a software vulnerability - they exploited a process vulnerability. By hijacking legitimate law enforcement email domains, they submitted emergency data requests that Revolut’s trust and safety workflow validated based on sender domain alone, without secondary out-of-band verification.

Emergency data requests are designed to bypass normal legal process timelines in life-threatening situations. This urgency is exactly what attackers exploit: the request format demands speed, discouraging the kind of callback verification that would catch a hijacked account. This is not unique to Revolut - the emergency data request abuse vector has been documented across major tech platforms since at least 2022, but this incident demonstrates it hitting financial services where the data exposed has immediate monetary value.

What defenders should do: Implement out-of-band verification for all emergency data requests - a callback to a verified law enforcement contact number, not the number provided in the request. Enforce DMARC validation on inbound government correspondence. Log and alert on emergency data request volume anomalies.

JFrog Artifactory Auth Bypass Chain Plants Backdoors in Build Pipelines

Attackers chained three authentication bypass vulnerabilities in JFrog Artifactory to gain admin access to artifact repositories, then planted backdoored packages that CI/CD pipelines pulled into production builds. The attack path is straightforward: compromise the repository that stores your build dependencies, swap in poisoned artifacts, and let the automated build system do the distribution.

This is a concrete instantiation of MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). The attackers did not need to compromise individual developer workstations or target specific build scripts - they poisoned the well. Every pipeline pulling from the compromised Artifactory instance ingested the backdoor automatically.

What defenders should do: Patch JFrog Artifactory immediately. Implement cryptographic artifact signing and signature verification in CI/CD pipelines. Audit build artifacts produced during the exposure window against known-good checksums. Deploy software composition analysis tooling that validates dependency provenance, not just vulnerability status.

Defender Action Items

  • GitLab (CVE-2026-85706): Patch all self-managed GitLab instances immediately. If internet-facing, assume compromise and conduct forensic review of CI/CD pipeline artifacts, service account activity, and file system integrity for the exposure window.
  • ConnectWise ScreenConnect: Apply emergency patch. Isolate ScreenConnect servers. Audit recent remote sessions for unexpected file transfers. Contact MSPs to confirm their patch status.
  • Emergency data request process: Implement out-of-band callback verification to known law enforcement numbers. Enforce DMARC on inbound government email. Alert on request volume anomalies.
  • JFrog Artifactory: Patch Artifactory. Implement artifact signing and provenance verification. Audit build outputs from the exposure window against known-good checksums.
  • CVE-2026-51990 (Sogou Input Method): Block or uninstall Tencent Sogou Input Method from enterprise endpoints. Scan for GrayRabbit backdoor indicators on endpoints with APAC-region software profiles.

Detection Queries

GitLab path traversal exploitation attempts can be detected in web server access logs by looking for directory traversal sequences targeting GitLab’s internal file paths. The following Splunk SPL query identifies potential CVE-2026-85706 exploitation attempts:

index=web sourcetype=gitlab_access_log
| regex uri_path="\.\./|%2e%2e%2f|%2e%2e/"
| where match(uri_path, "uploads|repositories|wiki|snippets")
| stats count by src_ip, uri_path, status, _time
| where count > 3
| sort - count

For ScreenConnect worm-like propagation detection, monitor for anomalous child process creation from the ScreenConnect service process. This KQL query identifies unexpected execution chains:

DeviceProcessEvents
| where InitiatingProcessFileName has_any ("ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe")
| where FileName !in~ ("conhost.exe", "cmd.exe")
| where ProcessCommandLine !has "ScreenConnect"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.