Feed›Vulnerability›Critical GitHub.com and Enterprise Server RCE Vulnerability ...
VulnerabilityCyber Security News
8.8 — CRITICAL

Critical GitHub.com and Enterprise Server RCE Vulnerability Enables Full Server Compromise

📅 28 April 2026 at 17:30 UTC📰 Cyber Security NewsView original source ↗
Critical GitHub.com and Enterprise Server RCE Vulnerability Enables Full Server Compromise

A critical remote code execution (RCE) vulnerability tracked as CVE-2026-3854 in GitHub’s internal git infrastructure that could have allowed any authenticated user to compromise backend servers, access millions of private repositories, and, in the case of GitHub Enterprise Server (GHES), achieve full server takeover. Discovered by Wiz researchers through AI-augmented reverse engineering of closed-source compiled […] The post Critical GitHub.com and Enterprise Server RCE Vulnerability Enables Full Server Compromise appeared first on Cyber Security News.

🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview

A critical remote code execution (RCE) vulnerability in GitHub's internal git infrastructure, CVE-2026-3854, allowed authenticated users to compromise backend servers and access private repositories, with the potential for full server takeover in Enterprise Server cases.

⚙️Technical Details
CVEs
CVE-2026-3854
Affected Systems
GitHub Enterprise Server
Attack Vectors
NETWORK
💥Impact Assessment
Severity: critical
Who Is at Risk
Authenticated users with push access to repositories, particularly those using GitHub Enterprise Server
🛡️Recommended Actions
1Immediately update GitHub Enterprise Server to the latest version
2Disable push access for all authenticated users until the vulnerability is patched
3Monitor repository activity and private data access closely for suspicious activity
📦Affected Products
Github Enterprise ServerGitHub Enterprise Server
🔐NVD Verified DataVERIFIED
CVE-2026-3854 ↗CVSS 8.8 — HIGH
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Affected Products (CPE)
Github Enterprise Server

Read the full article

This is a curated summary. The complete article is available at Cyber Security News.

Read on Cyber Security News ↗
← Back to feed