GitLab Critical Patch Release: 19.0.9, 18.11.12
On September 23, 2026, we released versions 19.0.9 and 18.11.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions backport the fixes for two critical vulnerabilities, CVE-2026-85706 and CVE-2026-87719, that were originally patched in 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026. These backports were made available outside of our standard maintenance policy so that self-managed administrators running 18.11 and 19.0 can apply the fixes without first completing a version upgrade. These versions contain no other changes. We strongly recommend that all self-managed GitLab installations still running 18.11 or 19.0 be upgraded to one of these versions immediately. In
Read at GitLab patch and security releases
- Vendor
- GitLab
- Product
- GitLab
- CVSS v3.1
- 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- Exploitation
- observed in the wild
- Fix
- available
- Exposure class
- Developer platform
Why it ranks 79 (Critical)
- Exploitation observed in the wild
- CVSS v3.1 10.0 critical
- Product class: developer platform
- Widely deployed vendor product (GitLab)
- Covered by 5 independent sources
- Fix available
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- GitLab patch and security releases (docs.gitlab.com)
- CVE-2026-85706 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-87719 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.