CISA Warns of Actively Exploited Gitea RCE

CISA added CVE-2026-60004, a critical Gitea remote code execution flaw with a CVSS score of 9.8, to its Known Exploited Vulnerabilities catalog. The vulnerability, patched in version 1.27.1, allows attackers with repository write access to execute shell commands via the diffpatch endpoint. Federal agencies must patch by August 28, 2026.