CVE WatchSep 12, 2026

CVE-2026-87719

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that

CVSS

9.9

Critical

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 12, 2026 · Last modified: Sep 12, 2026 · CWE-502

EPSS · 30d

Not enough EPSS history yet.

Technical description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-621078.8 HIG

—

———Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.14h CVE-2026-621059.8 CRI

—

———Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.14h CVE-2026-621039.8 CRI

—

———Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.14h CVE-2026-736997.2 HIG

—

——0FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional array is used instead of the required named-key array to disable class instantiation. Attackers with database write access can inject a serialized gadget chain into the permissions table columns processed on every authenticated page load to write arbitrary files, such as PHP webshells, to web-accessible paths.2d CVE-2026-817848.1 HIG

—

——0Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions.2d CVE-2026-829258.1 HIG

21.2%

——6The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.2d