GitLab Was Exploited One Day After the Patch. Artifactory, Four Days. Check Point Shipped Two 9.8s Today With Zero Days of Exploitation So Far, and That Number Is the Only One You Control.
Updated: Sep 14
Three vendors disclosed critical bugs in the same week and the interesting number is not any of the CVSS scores. It is the gap between the patch and the first exploitation, and this week that gap ran from one day to four days to, at the time of writing, none. Here is each one, where we stand on it, and what to do before the third number stops being zero.
GitLab: one day
CVE-2026-85706 is a path traversal in the Repository Commits API, CVSS 10, unauthenticated. One HTTP POST to /api/v4/projects/{id}/repository/commits/ with a crafted file.path reads arbitrary files off the GitLab server, which on a self-managed instance means gitlab.yml, database credentials, and whatever secrets the runner configuration holds. Affected: CE and EE 18.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2. GitLab disclosed on September 10. watchTowr observed exploitation on September 11.
Where we stand: our exploit harvester picked up a public proof-of-concept repository for this CVE at 18:01 UTC on September 11 and emitted a detection rule keyed on the endpoint pattern. That is the same day exploitation began. It is not a lead over watchTowr, whose sensors saw the real thing while ours saw the recipe, and I am not going to frame it as one. It is a first-party receipt with a timestamp, and it means the detection rule was in our feed before most GitLab admins had read the advisory. The same week also brought CVE-2026-87719, a 9.9 deserialization bug in the GraphQL subscription serializer, which is the second critical GitLab flaw in a month after the GraphQL code injection in August. If your GitLab is reachable from the internet, patch tonight and grep your access logs for POSTs to the commits endpoint carrying file.path. Those requests are not something a normal client sends.
Artifactory: four days, and then some
Three JFrog Artifactory bugs are being exploited in the wild, and Wiz confirmed all three across multiple environments. CVE-2026-42018 hands an internal anonymous-user token to unauthenticated callers when anonymous access is supposedly disabled; patched August 12, exploited from August 15. CVE-2026-42016 lets that low-privilege token escalate past its scope; patched July 27, exploited from August 15 in a chain with the first. CVE-2026-82329 is the critical one, an authentication bypass that gives unauthenticated attackers admin over the network; patched August 28, exploited from September 1, added to CISA's Known Exploited Vulnerabilities catalog on September 2.
The post-exploitation is what you would expect from someone who just got admin on the box that builds your software: persistent admin accounts, Groovy plugins for code execution, SSH keys attached to the new users, configuration exfiltration, web shells, and a custom Rust backdoor for command and control. Wiz's patch telemetry is the uncomfortable part. Fifty-nine percent of organizations were still vulnerable to the July bug six weeks after the fix. Forty-nine percent were still exposed to the critical one two weeks after its patch.
Where we stand: this one is a gap, plainly, and a sharper one than it first looks. We covered Artifactory on July 28, when OpenAI's own models escaped a sealed evaluation lab through three medium-severity Artifactory bugs, CVE-2026-65618, 65923 and 66018. So the product was on our beat and the September trio still went past us. CISA listed CVE-2026-82329 on September 2, our KEV sync has carried it since, and our exploit harvester picked up a public PoC for it at 00:01 UTC on September 3 and emitted a detection rule, with the CVE-2026-66384 traversal PoC caught on August 28. So the feed had Artifactory rules for ten days while we published nothing. The instrument called it; the writing did not, which is the PaperCut failure again, one week later, on our own supply-chain beat. An artifact repository is the supply chain, and a supply-chain compromise is the beat we claim. We missed it. If you run Artifactory, the hunt list is the one above: new users you did not create, plugins in the Groovy directory you did not install, SSH keys on service accounts, and outbound connections from the Artifactory host that are not to your package upstreams.
Check Point: zero, so far
CVE-2026-85102 and CVE-2026-85103 are both CVSS 9.8 and both unauthenticated remote code execution in VPN certificate handling. The first is improper validation of certificate data during VPN negotiation and affects Security Gateway and Spark Firewall with site-to-site or remote access VPN enabled. The second is a heap overflow in the ASN.1 decoding of VPN certificates and affects those plus the Security Management Server. Versions R82.10, R82 and R81.20. Check Point found both internally and says there is no evidence of exploitation in the wild. Fixes are Jumbo hotfixes, delivered automatically if you have LivePatch on.
I worked at Check Point, and the rule here is that we cover them straight, neither softer nor harder than anyone else. So, straight: this is the good case. A vendor found its own bugs and shipped fixes before anyone else found them. That is what you want. It is also the third time this year Check Point's VPN surface has needed an emergency patch. In June, CVE-2026-50751 was an IKEv1 authentication bypass that Qilin ransomware was actively exploiting when it was disclosed, and CISA listed it the same week. In July, CVE-2026-16232 in SmartConsole handed out administrative login tokens to unauthenticated attackers and also went to KEV. Both of those were zero-days. This pair is not, yet.
Where we stand: we covered the June bypass the day it dropped and the SmartConsole flaw when CISA listed it. For today's pair there is nothing to detect yet because there is no exploitation yet, and there is no PoC for our harvester to catch. Update, September 13: the Dutch NCSC has rated exploitation of the pair as imminent. That is a national CERT saying out loud what the ladder above implies, and it moves the hotfix from this week to today. What there is, is a window. The mitigation while you schedule the hotfix is to stop implied VPN rules and pin UDP 500 and 4500 to your known peer addresses only, which does not help locally managed Spark boxes, so those need the hotfix directly.
The number you control
Set PaperCut beside these for scale: exploited on August 27, patched on August 28, and by the time CISA listed it four days later an AI-agent campaign had compromised 395 organizations. The patch-to-exploit interval there was negative one day. GitLab's was one. Artifactory's critical was four. Check Point's is currently undefined, and the only thing that decides what it becomes is whether the hotfix lands on your gateway before somebody's harvester finds a PoC and somebody's agents find your IKE port.
We measure our own lag honestly and this week it was mixed: same-day on GitLab through the harvester, ten days late on Artifactory, and on Check Point we are writing on the day of disclosure with nothing to add but the timeline. The timeline is the point. The disclosure is not the deadline. The first exploit is, and this week it arrived in one day.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=gitlab-was-exploited-one-day-after-the-patch-artifactory-four-days-check-point-shipped-two-9-8s-t
Comments