CVE-2026-60004: Actively Exploited Vulnerability

CVE-2026-60004 is a critical-severity vulnerability (CVSS 9.8), listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as actively exploited.

Summary

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Remediation

It is actively exploited — apply the vendor’s patch immediately and prioritize internet-facing systems. Patch-management tools that can deploy and verify the fix include Action1, Automox, ManageEngine Patch Manager Plus, ManageEngine Endpoint Central. See our best patch management ranking.

Sources

• https://blog.gitea.com/release-of-1.27.1/
• https://github.com/0xBlackash/CVE-2026-60004
• https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
• https://www.runzero.com/blog/gitea/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004