Search/CVE-2026-60004
● CVE — Critical

CVE-2026-60004

VendorgiteaProductgiteaDiscoveredAug 26, 2026UpdatedAug 27, 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

View graph Watch Export
CVSS v3.1
9.8 CRITICAL
EPSS
24.0%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
5
sources referencing this CVE
Related IOCs
1
seen in the same coverage
EPSS Trend
Aug 28, 2026 → Sep 25, 2026
▼ 58.4pp
82.4% → 24.0% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
10 relationships
Timeline
disclosure → media coverage
Aug 26, 2026
securityweek.com reports: CISA Warns of Exploited Gitea Vulnerability
Aug 26, 2026
thehackernews.com reports: Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
Aug 26, 2026
helpnetsecurity.com reports: Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
Aug 26, 2026
Disclosure — published as a CVE record.
Sep 22, 2026
helpnetsecurity.com reports: Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
Sep 22, 2026
bleepingcomputer.com reports: Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
Public PoC (10)
github.com/HORKimhab/CVE-2026-60004github.com/EQSTLab/CVE-2026-60004github.com/0xredash/CVE-2026-60004github.com/imbas007/CVE-2026-60004-POCgithub.com/shinthink/CVE-2026-60004github.com/HackSpeak/CVE-2026-60004github.com/Sachinart/CVE-2026-60004-gitea-0daygithub.com/gagaltotal/CVE-2026-60004-poc-giteagithub.com/yym8538/CVE-2026-60004github.com/fevar54/cve-2026-60004
Unverified third-party code — review before executing.