CISA KEV Warning: Patch Gitea CVE-2026-60004 Now!

CISA just warned that Gitea servers are actively being hacked. If you're running an unpatched instance, someone might already have remote execution privileges on your infrastructure. I've got to confess. When I first saw the security notice for CVE-2026-60004, I figured it was just another routine API bug. Honestly, I almost scrolled past it. But I was dead wrong. This is a critical code injection vulnerability in the diffpatch API. CISA just added it to their Known Exploited Vulnerabilities catalog. That means threat actors are actively using it right now to run commands on host servers. Under the Binding Operational Directive 26-04, the compliance deadline is ticking down. You need to act immediately. Here are the three things you must do right now to protect your environment. First, let's look at how the exploit works. The vulnerability is in Gitea's diffpatch API. Attackers send a crafted request that changes how diffs are processed. This lets them write malicious code straight into the repository's git hooks. Once those hooks trigger, the attacker gets full remote code execution. They'll have the exact same permissions as your Gitea service. Second, check for indicators of compromise. Audit your Gitea versions immediately to see if you're exposed. Look through your server logs for weird API requests targeting that diffpatch endpoint. You should also inspect the hooks directory in your repositories for unauthorized scripts. Keep a close eye out in the pre-receive or update hooks. Third, patch this thing. The only real solution is upgrading Gitea to the latest patched version. If you can't upgrade right away, you've got to temporarily disable git hooks for all non-admin users. You should also restrict access to the Gitea API and set up your web application firewall to block suspicious diffpatch payloads. Don't wait for a breach to find out you're vulnerable. Audit your Gitea servers today. Apply those security patches and make sure your team meets the CISA deadline. Subscribe for more urgent security updates, and share this with your DevSecOps team now.