CISA Warns of Exploited Gitea Vulnerability

CVE-2026-60004 is a remote code execution vulnerability in Gitea that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint, planting an executable Git hook and executing shell commands as the Gitea service account. This vulnerability was patched by Gitea developers in late July 2026 with the release of version 1.27.1. The threat actor Red Heron exploited this vulnerability rapidly, scanning 1,386 Gitea instances in seven countries and compromising organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. The attacker conducted activities including source code theft, credential collection, SSH persistence, lateral movement, and privilege escalation to root on a Proxmox cluster. The campaign used advanced malware implants such as JITTERLY, a C++ Linux implant with extensive post-exploitation capabilities, and SIXZUT, a previously undocumented LD_PRELOAD rootkit capable of hiding files, processes, and network connections while protecting the implant from termination. CISA has added the vulnerability to its KEV catalog and instructed federal agencies to patch by August 28, 2026.

Successful exploitation allows attackers to execute arbitrary code as the Gitea service account, enabling source code theft, credential harvesting, persistence via SSH, lateral movement within networks, and privilege escalation to root on critical infrastructure. The use of advanced implants and rootkits enables stealthy long-term access and evasion of detection. The compromise affected multiple countries and targeted sensitive sectors including defense, elections, energy, aerospace, telecommunications, and government.

A patch fixing CVE-2026-60004 is available in Gitea version 1.27.1, released in late July 2026. Organizations should upgrade to version 1.27.1 or later immediately. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and mandated patching by August 28, 2026. No additional vendor advisories indicate alternative mitigations or that no action is required.