{"id":5122,"date":"2026-09-29T20:35:51","date_gmt":"2026-09-29T20:35:51","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/09\/29\/cve-2026-60004-cisa-avertit-des-attaques-actives-que-des-milliers-de-serveurs-restent-exposes\/"},"modified":"2026-09-29T20:35:52","modified_gmt":"2026-09-29T20:35:52","slug":"cve-2026-60004-cisa-avertit-des-attaques-actives-que-des-milliers-de-serveurs-restent-exposes","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/fr\/2026\/09\/29\/cve-2026-60004-cisa-avertit-des-attaques-actives-que-des-milliers-de-serveurs-restent-exposes\/","title":{"rendered":"CVE-2026-60004: CISA avertit des attaques actives que des milliers de serveurs restent expos\u00e9s"},"content":{"rendered":"<div id=\"netgu-3079009379\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p class=\"wp-block-paragraph\"><strong>Le 25 ao\u00fbt 2026, la cyberagence am\u00e9ricaine CISA a ajout\u00e9 le d\u00e9faut critique CVE-2026-60004 \u00e0 son catalogue de vuln\u00e9rabilit\u00e9s exploit\u00e9es (KEV) et a ordonn\u00e9 aux agences f\u00e9d\u00e9rales de corriger avant le 28 ao\u00fbt. Selon Shadowserver, environ 8 400 serveurs de Gitea face \u00e0 Internet \u00e9taient encore vuln\u00e9rables \u00e0 la fin du mois d&#8217;ao\u00fbt.<\/strong><\/p>\n<h3 class=\"wp-block-heading\">Pourquoi le d\u00e9faut est si dangereux<\/h3>\n<p class=\"wp-block-paragraph\">Le CVE-2026-60004 est une vuln\u00e9rabilit\u00e9 \u00e0 l&#8217;injection de code (CWE-94) qui porte le score maximum du CVSS de 9,8. Les <code>diffpatch<\/code> Endpoint de l&#8217;API, un attaquant avec acc\u00e8s \u00e9crit \u00e0 un d\u00e9p\u00f4t peut soumettre un patch con\u00e7u, planter un crochet Git ex\u00e9cutable et ex\u00e9cuter des commandes shell arbitraires avec les privil\u00e8ges du compte de service Gitea. Les installations par d\u00e9faut sont livr\u00e9es avec l&#8217;auto-enregistrement ouvert activ\u00e9, de sorte qu&#8217;un attaquant non authentifi\u00e9 peut cr\u00e9er son propre compte, cr\u00e9er un d\u00e9p\u00f4t et d\u00e9clencher la faille sans acc\u00e8s pr\u00e9alable.<\/p><div id=\"netgu-2998887622\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/moon-knight-digital-watch-face-fuer-wear-os-4\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/deal-27-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">MOON KNIGHT Digital Watch Face f\u00fcr Wear OS 4+<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>0.89 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/train-sim-world-7-starter-pack-kostenlos-fuer-ps4-ps5-xbox-pc\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/capsule_616x353-11-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Train Sim World 7: Starter Pack kostenlos f\u00fcr PS4, PS5, Xbox, PC<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ml2u-watchfaces-fuer-wearos-im-google-play-store-2\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2844734_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">ML2U Watchfaces f\u00fcr WearOS im Google Play Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>1.39 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenloses-dlc-bundle-fuer-gears-of-war-e-day-liquid-death-bundle\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2844571_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenloses DLC-Bundle f\u00fcr Gears of War E-Day \u2013 Liquid Death Bundle<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenlose-emote-im-clash-royale-store\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/share-image-clashroyale-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenlose Emote im Clash Royale-Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n<h3 class=\"wp-block-heading\">Exploitation dans la nature<\/h3>\n<p class=\"wp-block-paragraph\">Les chercheurs en s\u00e9curit\u00e9 signalent des scanners automatis\u00e9s compromettant les instances vuln\u00e9rables en quelques secondes et laissant tomber une charge utile semblable \u00e0 une cryptomonnaie mineure. Par CISA et Gitea, chaque sortie de la version 1.17 est affect\u00e9e. Le vendeur a ferm\u00e9 le trou de Gitea 127.1 en cr\u00e9ant le d\u00e9p\u00f4t temporaire utilis\u00e9 dans les op\u00e9rations de patch comme clone non-bare.<\/p>\n<h3 class=\"wp-block-heading\">Ce que les administrateurs devraient faire maintenant<\/h3>\n<ul class=\"wp-block-list\"><li>Mise \u00e0 jour de Gitea <strong>127.1<\/strong> ou plus tard imm\u00e9diatement.<\/li><li>D\u00e9sactiver l&#8217;auto-enregistrement ouvert \u00e0 moins qu&#8217;il ne soit strictement n\u00e9cessaire.<\/li><li>Ne pas exposer les instances de Gitea \u00e0 Internet sans protection; restreindre l&#8217;acc\u00e8s.<\/li><li>Serveurs d&#8217;audit pour comptes inconnus, d\u00e9p\u00f4ts voyous et crochets suspects Git.<\/li><\/ul>\n<p class=\"wp-block-paragraph\"><em>Sources : <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks\/\" rel=\"noopener\" target=\"_blank\">Calculateur<\/a>, <a href=\"https:\/\/thehackernews.com\/2026\/08\/critical-gitea-rce-actively-exploited.html\" rel=\"noopener\" target=\"_blank\">Les nouvelles Hacker<\/a>, <a href=\"https:\/\/www.securityweek.com\/cisa-warns-of-exploited-gitea-vulnerability\/\" rel=\"noopener\" target=\"_blank\">Semaine de la s\u00e9curit\u00e9<\/a>, <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/08\/26\/gitea-cve-2026-60004-exploited-in-the-wild\/\" rel=\"noopener\" target=\"_blank\">Aide \u00e0 la s\u00e9curit\u00e9 du r\u00e9seau<\/a>, <a href=\"https:\/\/blog.gitea.com\/release-of-1.27.1\/\" rel=\"noopener\" target=\"_blank\">Blog Gitea<\/a>.<\/em><\/p><div id=\"netgu-1438564812\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>La cyberagence am\u00e9ricaine CISA a ajout\u00e9 le d\u00e9faut critique de Gitea CVE-2026-60004 (CVSS 9.8) \u00e0 son catalogue de vuln\u00e9rabilit\u00e9s exploit\u00e9es connues. \u00c0 la fin du mois d&#8217;ao\u00fbt, environ 8 400 serveurs n&#8217;avaient pas \u00e9t\u00e9 affect\u00e9s.<\/p>\n","protected":false},"author":1,"featured_media":1722,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-5122","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/5122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=5122"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/5122\/revisions"}],"predecessor-version":[{"id":5123,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/5122\/revisions\/5123"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1722"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=5122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=5122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=5122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}