GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

September 29, 2026 · 12:00 pm 4 sources

Image: CISA

Coverage

Wires & papers of record

• MikroTik RouterOS
  CISA · September 29, 2026 12:00
  View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service. The following versions of MikroTik RouterOS are affected: RouterOS <7.24 (CVE-2026-84411) CVSS Vendor Equipment Vulnerabilities v3 9.8 MikroTik…

Coverage

• CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS
  BleepingComputer · September 30, 2026 15:49
  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a new critical vulnerability in MikroTik RouterOS that could lead to remote code execution or cause a denial-of-service condition. [...]
• GitLab warns of critical RCE vulnerability in AI Gateway service
  BleepingComputer · October 2, 2026 16:20
  GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. [...]

More coverage

• GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
  The Hacker News · October 2, 2026 17:33
  A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own…