Changeflow GovPing Data Privacy & Cybersecurity GitLab Multiple Vulnerabilities Allow Remote Co...

Urgent Notice Added Final

GitLab Multiple Vulnerabilities Allow Remote Code Execution, DoS, Data Breach

Published April 9th, 2026

Detected April 9th, 2026

Summary

CERT-FR issued an alert on 11 critical vulnerabilities in GitLab Community and Enterprise Edition affecting versions before 18.10.3, 18.9.5, and 18.8.9. The flaws allow remote code execution, denial of service attacks, and data confidentiality breaches. Users must patch to version 18.10.3 or later to remediate.

View original document View source feed page

What changed

CERT-FR published an advisory identifying 11 critical vulnerabilities in GitLab CE/EE across three version branches (prior to 18.10.3, 18.9.5, and 18.8.9). The vulnerabilities include CVE-2025-12664, CVE-2025-9484, CVE-2026-1092, CVE-2026-1101, CVE-2026-1403, CVE-2026-1516, CVE-2026-1752, CVE-2026-2104, CVE-2026-2619, CVE-2026-4332, CVE-2026-4916, and CVE-2026-5173. Attackers can exploit these to achieve remote code execution, cause denial of service, bypass security controls, or exfiltrate confidential data.

Organizations running affected GitLab installations must patch to 18.10.3 or later without delay. Self-hosted GitLab deployments are directly exposed and require immediate vendor patch application. Organizations should audit logs for signs of exploitation and monitor the GitLab security release page for additional patches addressing newly disclosed CVEs.

What to do next

Patch GitLab to version 18.10.3 or later immediately
Review systems for indicators of compromise using listed CVEs
Monitor GitLab security bulletins for additional updates

Archived snapshot

Apr 9, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 09 avril 2026 N° CERTFR-2026-AVI-0410 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans GitLab

Gestion du document

Risques

Atteinte à la confidentialité des données
Contournement de la politique de sécurité
Déni de service à distance
Exécution de code arbitraire à distance
Injection de code indirecte à distance (XSS)

Systèmes affectés

GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.10.x antérieures à 18.10.3
GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions 18.9.x antérieures à 18.9.5
GitLab Community Edition (CE) et Gitlab Enterprise Edition (EE) versions antérieures à 18.8.9

Résumé

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Bulletin de sécurité GitLab du 08 avril 2026
https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/
Référence CVE CVE-2025-12664
https://www.cve.org/CVERecord?id=CVE-2025-12664
Référence CVE CVE-2025-9484
https://www.cve.org/CVERecord?id=CVE-2025-9484
Référence CVE CVE-2026-1092
https://www.cve.org/CVERecord?id=CVE-2026-1092
Référence CVE CVE-2026-1101
https://www.cve.org/CVERecord?id=CVE-2026-1101
Référence CVE CVE-2026-1403
https://www.cve.org/CVERecord?id=CVE-2026-1403
Référence CVE CVE-2026-1516
https://www.cve.org/CVERecord?id=CVE-2026-1516
Référence CVE CVE-2026-1752
https://www.cve.org/CVERecord?id=CVE-2026-1752
Référence CVE CVE-2026-2104
https://www.cve.org/CVERecord?id=CVE-2026-2104
Référence CVE CVE-2026-2619
https://www.cve.org/CVERecord?id=CVE-2026-2619
Référence CVE CVE-2026-4332
https://www.cve.org/CVERecord?id=CVE-2026-4332
Référence CVE CVE-2026-4916
https://www.cve.org/CVERecord?id=CVE-2026-4916
Référence CVE CVE-2026-5173
https://www.cve.org/CVERecord?id=CVE-2026-5173

Gestion détaillée du document

le 09 avril 2026 Version initiale

Related changes

Multiple Microsoft Office Vulnerabilities Allow Remote Code Execution, Data Breach

Priority review Apr 15, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Multiple Vulnerabilities in SAP Products Allow Remote Code Execution

Priority review Apr 14, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Adobe Product Vulnerabilities Allow Remote Code Execution, DoS, Security Bypass

Urgent Apr 15, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

CERT-FR Security Advisories cert.ssi.gouv.fr/avis

Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

April 9, 2026

Press inquiries →

Classification

Agency

CERT-FR

Published

April 9th, 2026

Instrument

Notice

Legal weight

Non-binding

Stage

Final

Change scope

Substantive

Document ID

CERTFR-2026-AVI-0410

Who this affects

Applies to

Technology companies Manufacturers Developers

Industry sector

5112 Software & Technology

Activity scope

Software patching Vulnerability management Security advisory response

Geographic scope

France FR

Taxonomy

Primary area

Cybersecurity

Operational domain

IT Security

Compliance frameworks

NIST CSF

Topics

Data Privacy

Browse Categories

Agriculture & Food Safety 65 AI Regulation 3 Banking & Finance 314 Consumer Protection 46 Courts & Legal 361 Data Privacy & Cybersecurity 76 Defense & National Security 51 Education 22 Energy 100 Environment 86 Environmental & Energy 13 Environmental Regulation 7 Financial Regulation 2 Government & Legislation 279 Government Operations 15 Healthcare 136 Healthcare & Life Sciences 6 Housing 16 Immigration 8 Immigration & Border Control 2 Insurance 58 Labor & Employment 115 Legal & Judicial 11 Pharma & Drug Safety 104 Public Health 2 Real Estate & Housing 4 Sanctions & Export Controls 1 Securities & Investments 14 Securities & Markets 103 Securities Regulation 6 Tax 65 Tax & Revenue 1 Telecom & Technology 47 Trade & Commerce 3 Trade & Sanctions 135 Transportation 60