Is CVE-2026-60004 actively exploited?

Yes. Previdian tracks CVE-2026-60004 as a known exploited vulnerability. Confidence is confirmed.

What exploitation activity has Previdian observed?

Previdian has not yet recorded sensor-observed exploitation attempts for CVE-2026-60004. Our sensors continue to monitor for activity targeting this CVE.

Which versions are affected?

CVE-2026-60004 affects Gitea Gitea. Reported affected version: 1.17 to < 1.27.1.

Yes. CVE-2026-60004 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-60004 Exploited in the Wild — Gitea

Q: What is CVE-2026-60004?

CVE-2026-60004 is an unauthenticated vulnerability affecting Gitea Gitea. Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Q: How should organizations remediate it?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Q: Is it in CISA KEV?

Yes. CVE-2026-60004 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-60004 is an unauthenticated vulnerability affecting Gitea Gitea. Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Is it exploited?

Yes. Previdian tracks this CVE as a known exploited vulnerability. Confidence is confirmed. Listed in CISA KEV. Also confirmed by third-party sources.

Who is affected?

Gitea / Gitea affected before 1.27.1.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Vendor Product Affected Status

Gitea Gitea Before 1.27.1 Affected

Published: 26 Aug 2026
Exploitation Reported: 25 Aug 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-60004
blog.gitea.com/release-of-1.27.1 blog.gitea.com · CVE Record https://blog.gitea.com/release-of-1.27.1/
GitHub — go-gitea/gitea github.com · CVE Record https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-...
runzero.com/blog/gitea runzero.com · CVE Record https://www.runzero.com/blog/gitea/
GitHub — 0xBlackash/CVE-2026-60004 github.com · CVE Record https://github.com/0xBlackash/CVE-2026-60004

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

CISA

Recorded 25 Aug 2026

Independent exploitation attestation added to the Previdian record.

Proof of concept available

Pruva

Recorded 29 Jul 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
CISA First	2026-08-25 10:47 UTC
TheHackerNews	2026-08-26 06:27 UTC
CERT Polska	2026-08-26 11:59 UTC
CVE	2026-08-26 21:01 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets: 0
User-Agents: 0

Raw values available in Pro and Enterprise.

Scanner coverage

Nuclei template detected 27 Aug 2026.

View Nuclei template

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-60004.yaml	27 Aug 2026

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

—

Weaknesses

Improper Control of Generation of Code ('Code Injection') CWE-94

Recent mention · CERT Polska

Krytyczna podatność w Gitea

Zespół CERT Polska informuje o krytycznej podatności w Gitea, oznaczonej jako CVE-2026-60004.Podatność pozwala atakującemu z dostępem do zapisu w repozytorium na zdalne wykonanie dowolnych poleceń systemowych z uprawnieniami użytkownika usługi Gitea. Wykorzystanie podatności...

Read full advisory

All Mentions

Recent mention · CERT Polska

Krytyczna podatność w Gitea

CERT Polska · 26 Aug 2026

Zespół CERT Polska informuje o krytycznej podatności w Gitea, oznaczonej jako CVE-2026-60004.Podatność pozwala atakującemu z dostępem do zapisu w repozytorium na zdalne wykonanie dowolnych poleceń systemowych z uprawnieniami użytkownika usługi Gitea. Wykorzystanie podatności wymaga posiadania konta, jednak domyślna konfiguracja Gitea umożliwia otwartą rejestrację nowych użytkowników bez konieczności akceptacji przez administratoraProblem dotyczy wersji od 1.17 do 1.27.0 włącznie.Podatność jest aktywnie wykorzystywana do przeprowadzania ataków. W związku z tym rekomendujemy analizę logów w...

Recent mention · TheHackerNews

Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload

TheHackerNews · 26 Aug 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability in question is CVE-2026-60004 (CVSS score: 9.8), a case of remote code execution that allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as the

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

gagaltotal/CVE-2026-60004-poc-gitea

github · Created 2026-08-08 13:08:31 UTC · 2 stars · AI assessment 90%

CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection

Sachinart/CVE-2026-60004-gitea-0day

github · Created 2026-08-04 22:51:05 UTC · 0 stars · AI assessment 90%

CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE

HackSpeak/CVE-2026-60004

github · Created 2026-08-04 12:16:59 UTC · 1 stars · AI assessment 90%

Gitea diffpatch RCE (CVE-2026-60004) PoC - repo-write to RCE as Gitea service account

EQSTLab/CVE-2026-60004

github · Created 2026-07-30 08:19:19 UTC · 1 stars · AI assessment 90%

Gitea diffpatch RCE

Gitea diffpatch Git hook installation leads to remote code execution

pruva · Created 2026-07-29 10:56:28 UTC

Severity: CRITICAL | CVE: CVE-2026-60004 | Package: go-gitea/gitea

Gitea <= 1.27.0 - Pre-Auth Remote Code Execution

nuclei · Created Unknown

Timeline

From disclosure to observed exploitation

27 Aug 2026
Nuclei template available

Scanner coverage available
26 Aug 2026
KEV confirmed by CVE

Exploitation attested by an external source
26 Aug 2026
CVE published

Vulnerability disclosed publicly
26 Aug 2026
KEV confirmed by CERT Polska

Exploitation attested by an external source
26 Aug 2026
KEV confirmed by TheHackerNews

Exploitation attested by an external source
25 Aug 2026
Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
29 Jul 2026
Public PoC available

Public proof-of-concept code published
08 Jul 2026
CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-60004

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2026-60004",
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "cvss_estimated": false,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2026-60004

What security teams need to know first

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation

Tags

CVE References

Why Previdian marks this CVE as exploited

Exploited in the wild

Proof of concept available

Known exploited vulnerability sources

Operational artifacts and observed signals

Observed signals

Scanner coverage

Virtual patch status

Scanner Artifacts

Severity, weaknesses, and research context

Weaknesses

Krytyczna podatność w Gitea

All Mentions

Potential Proof of Concepts

From disclosure to observed exploitation

Nuclei template available

KEV confirmed by CVE

CVE published

KEV confirmed by CERT Polska

KEV confirmed by TheHackerNews

Added to CISA KEV

Public PoC available

CVE ID reserved

Automate this intelligence

Get alerts on high-impact exploitation