A critical remote code execution vulnerability in Gitea, the self-hosted Git service popular with teams that do not want to rely on GitHub or GitLab, is now being actively exploited in the wild, prompting CISA to add it to its Known Exploited Vulnerabilities catalog on August 25 and researchers to confirm real-world attacks by August 26, 2026. Tracked as CVE-2026-60004 with a CVSS score of 9.8, the flaw lives in Gitea's diffpatch handling: an attacker who already has ordinary write access to a single repository, something as simple as registering an account on an instance that allows open sign-up and creating a repo, can submit a crafted patch that gets processed into an executable Git hook. Once that hook runs, the attacker executes arbitrary shell commands as the operating-system user running Gitea, which on many self-hosted setups has broad access to the underlying server. Gitea actually patched this quietly back in late July with version 1.27.1, but the vulnerability had no confirmed exploitation until a proof-of-concept became public, after which at least one operator discovered their instance had been compromised when their hosting provider flagged abnormal CPU usage; the payload dropped was a cryptocurrency-mining-style dropper rather than anything more sophisticated, but the access it demonstrates would support much worse. CISA has given federal agencies until August 28 to patch. For any team running self-hosted Gitea, a common choice for startups, internal tooling, and privacy-conscious engineering orgs, the practical takeaway is to check the installed version immediately, upgrade to 1.27.1 or later if still on 1.17 through 1.27.0, and audit repository-level write permissions and open registration settings, since the attack chain depends on an attacker being able to get write access in the first place, not on network-level exposure alone.