Turan Security xavfsizlik byulleteni — GitLab CVE-2026-85706

Xavf darajasi: Critical — CVSS 10.0
Holati: Faol ekspluatatsiya tasdiqlangan (CISA KEV)

GitLab CE/EE tizimlarida CVE-2026-85706 — kritik Path Traversal, Arbitrary File Read zaifligi aniqlandi. Repository commits API’dagi autentifikatsiya tekshiruvlarining yetarli emasligi tufayli masofadagi, autentifikatsiyadan o‘tmagan hujumchi serverdagi ixtiyoriy fayllarni — konfiguratsiyalar, tokenlar, kalitlar va credentiallarni o‘qishi mumkin.

Zaiflik ta'sir etuvchi versiyalar:

GitLab CE/EE:
18.7 – 19.1.8 gacha
19.2 – 19.2.6 gacha
19.3 – 19.3.2 gacha

Xavfsiz versiyalar:

19.1.8, 19.2.6, 19.3.2 yoki keyingi versiyalar.
Tavsiyalar:
GitLab versiyasini zudlik bilan yangilash;
Gitlabni ichki perimeterga ko'chirish;

Tavsiyalarga tezroq e'tibor berishga chaqiramiz, sababi exploit allaqachon ommaga ochiqlangan.

Turan Security tashkilotlarni GitLab infratuzilmasini zudlik bilan inventarizatsiya qilish va yangilashga chaqiradi.

@turansecurity | www.turansec.uz | info@turansec.uz

Turan Security kompaniyasi Cyber Security Summit | CENTRAL EURASIA – CSS 2026 ishtirokchilari safida!
Turan Security — yetakchi kiberxavfsizlik kompaniyasi va Markaziy Osiyodagi birinchi CVE Numbering Authority (CNA) hisoblanadi. Kompaniya tadqiqotchilari NASA, Google, Nvidia, Amazon, Alibaba kabi global texnologiya kompaniyalarining Hall of Fame dasturlarida ham e'tirof etilgan.
120 dan ortiq mijozga ega kompaniya SOC as a Service, penetratsion testlar, ISO/IEC 27001 va PCI DSS bo'yicha konsalting hamda auditlar, DevSecOps va boshqa kiberxavfsizlik xizmatlarini taqdim etadi. Ushbu xizmatlar tashkilotlarga kiberxatarlarni boshqarish, xavfsizlik nazorati vositalarini mustahkamlash va muhim raqamli infratuzilmani himoya qilishda yordam beradi.
CSS 2026 doirasida Turan Security o'zining Bug bounty va Threat intelligence platformalarini namoyish etadi — ular zaifliklarni aniqlash, yangi tahdidlarni kuzatib borish va tashkilotlarning umumiy xavfsizlik darajasini oshirish uchun amaliy yechimlarni taklif qiladi.
Turan Security jamoasi bilan 6–7 oktabr kunlari Toshkentda bo'lib o'tadigan CSS 2026 da uchrashing!


We are pleased to welcome Turan Security to Cyber Security Summit | CENTRAL EURASIA – CSS 2026!

Turan Security is a leading cybersecurity company and the first CVE Numbering Authority (CNA) in Central Asia. Its cybersecurity researchers have also been recognised in the Hall of Fame programmes of global technology companies like NASA, Google, Nvidia, Amazon, Alibaba.

With a portfolio of 120+ clients, company provides SOC as a Service, penetration testing, ISO/IEC 27001 and PCI DSS consulting and audits, DevSecOps, and other cybersecurity services designed to help organisations manage cyber risks, strengthen security controls and protect critical digital infrastructure.

At CSS 2026, Turan Security will showcase its bug bounty and threat intelligence platforms, offering practical solutions for identifying vulnerabilities, monitoring emerging threats and strengthening organisations’ overall security posture.

Meet the Turan Security team at CSS 2026 in Tashkent on 6-7 October.