Vulnerabilityhigh
88% of self-hosted GitHub servers exposed to RCE, researchers warn (CVE-2026-3854)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-3854 | Header-injection RCE via git push options in GitHub Enterprise Server | 8.7 | 40% |
From the original article
2 min read at helpnetsecurity.com
When researchers at Wiz reported an easily exploitable GitHub remote code execution flaw (CVE-2026-3854) on March 4, the company confirmed it within 40 minutes and pushed a fix to GitHub. com in under two hours. But for too many of the thousands of organizations running GitHub Enterprise Server on their own infrastructure, the vulnerability still represents a risk.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.