More than 8,300 internet-exposed Gitea instances remain unpatched against a critical code-execution vulnerability that is being exploited in ongoing attacks, according to BleepingComputer, citing cybersecurity watchdog Shadowserver. The flaw, tracked as CVE-2026-60004, affects Gitea’s diffpatch API endpoint. BleepingComputer reports that Salesforce security researcher Shai Rod reported the issue, which can let authenticated attackers execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches. The authentication requirement may not be much of a barrier on default deployments. According to BleepingComputer’s account of Gitea’s security advisory, exploitation requires ordinary write access to a repository hosted on a vulnerable server. But Gitea enables self-registration by default, meaning an unauthenticated visitor may be able to register an account, create a repository, and reach the required write-access condition without preexisting credentials. Gitea shipped version 1.27.1 on July 27 to address CVE-2026-60004 and urged users to upgrade. Shadowserver said it was scanning and reporting exposed Gitea instances vulnerable to the code-injection issue and found 8,393 vulnerable IPs on August 27, according to BleepingComputer. The issue has also reached the U.S. government’s emergency patching pipeline. BleepingComputer reports that the Cybersecurity and Infrastructure Security Agency added CVE-2026-60004 to its catalog of actively exploited flaws on Tuesday and ordered Federal Civilian Executive Branch agencies to patch affected servers within three days, by August 28, under Binding Operational Directive 26-04. CISA has not shared further details on the attacks in the provided report. BleepingComputer says the catalog addition was likely prompted by reports of in-the-wild exploitation in which attackers deployed cryptocurrency-mining malware on unpatched Gitea servers. The exposure matters because Gitea is a self-hosted code hosting and DevOps platform used as an alternative to cloud-hosted services such as GitHub, GitLab, and Bitbucket. BleepingComputer says Gitea has more than 400,000 installations and nearly 1,500 contributors, which makes fast remediation important for organizations that run their own development infrastructure. The same report notes that Gitea has recently faced another critical issue: in July, threat actors were spotted abusing CVE-2026-20896, an authentication-bypass flaw in the official Gitea Docker image affecting instances with reverse-proxy authentication headers enabled. That does not change the remediation for CVE-2026-60004, but it adds urgency for teams to audit how their Gitea deployments are exposed and configured. Who benefits: Attackers benefit from unpatched, internet-facing Gitea deployments where self-registration remains open. Defenders benefit from a clear patched version, Gitea 1.27.1, and Shadowserver’s scanning signal. Who's exposed: Organizations running self-hosted Gitea instances are exposed, especially if their servers are reachable from the internet and still allow default open registration. U.S. federal civilian agencies faced a specific August 28 patch deadline under CISA’s directive.