Attackers are exploiting a critical vulnerability in Gitea, the self-hosted Git service, according to BleepingComputer, which cites the U.S. Cybersecurity and Infrastructure Security Agency’s latest Known Exploited Vulnerabilities catalog action. The flaw is tracked as CVE-2026-60004. BleepingComputer reports that it affects Gitea’s diffpatch API endpoint and can let a user with repository write access execute arbitrary shell commands with the privileges of the Gitea service account. The vulnerability was reported by Salesforce security researcher Shai Rod, according to the report. The access requirement matters because it may be easier to satisfy than it first appears. BleepingComputer reports that default-configured Gitea instances have self-registration enabled. Under that configuration, an unauthenticated visitor could register an account, create a repository, and obtain the repository write access needed to trigger the vulnerability. Gitea’s own security explanation, cited by BleepingComputer, says the diffpatch endpoint can be abused to install and run a Git hook from content controlled by a repository. In practical terms, that turns repository write access into command execution as the operating-system user running Gitea. Gitea released version 1.27.1 on July 27 to address CVE-2026-60004, BleepingComputer reports, and advised administrators to upgrade their servers. Shadowserver is tracking nearly 5,000 Gitea instances exposed online, according to the report, though it is not known how many are honeypots or have already been secured against this flaw. CISA added the vulnerability to its KEV catalog on Tuesday and directed U.S. Federal Civilian Executive Branch agencies to secure affected systems within three days, by August 28, under Binding Operational Directive 26-04, according to BleepingComputer. The agency did not provide additional details about the attacks. BleepingComputer says CISA’s action was likely prompted by reports of in-the-wild exploitation in which attackers deployed cryptocurrency mining malware on unpatched Gitea servers. That detail remains reported through BleepingComputer in the provided material; the cluster does not include separate telemetry, indicators of compromise, or victim counts. The operational takeaway is narrow but urgent: organizations running self-hosted Gitea should verify whether they are on version 1.27.1 or later, review whether public registration is enabled, and prioritize remediation if the instance is reachable from the internet. CISA’s catalog listing is a strong signal that exploitation is no longer theoretical, even though the public detail on the campaigns remains limited. Who benefits: Attackers benefit when Gitea instances are internet-exposed, unpatched, and allow open self-registration. Defenders benefit from a clear fixed version and a CISA KEV deadline that helps justify emergency remediation. Who's exposed: Organizations running vulnerable self-hosted Gitea servers are exposed, especially if default open registration remains enabled. Federal civilian agencies face a specific August 28 remediation deadline under CISA’s directive.