Critical GitHub.com and Enterprise Server RCE Vulnerability Enables Full Server Compromise

Cybersecuritynews •Guru Baran • April 28, 2026

A critical remote code execution (RCE) vulnerability tracked as CVE-2026-3854 in GitHub’s internal git infrastructure that could have allowed any authenticated user to compromise backend servers, access millions of private repositories, and, in the case of GitHub Enterprise Server (GHES), achieve full server takeover. Discovered by Wiz researchers through AI-augmented reverse engineering of closed-source compiled […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub Patches Critical RCE Vulnerability CVE-2026-3854 A critical remote code execution vulnerability, tracked as CVE-2026-3854, was discovered in GitHub's internal git infrastructure, allowing authenticated users to execute arbitrary commands via a crafted git push command. The flaw, identified by Wiz researchers using AI, affects both GitHub.com and GitHub Enterprise Server, potentially exposing millions of repositories. GitHub's rapid response included patching the issue within six hours of disclosure on March 4, 2026. Despite the swift action, reports indicate that 88% of GitHub Enterprise Server instances remained vulnerable at the time of public disclosure. The vulnerability stems from improper sanitization of user-supplied push options, allowing command injection. GitHub has released patches for all affected versions, and no evidence of exploitation was found prior to the patch. The incident highlights significant security risks associated with internal protocols and user input handling. 49 sources 72

Extracted Entities

CVEs (1)

CVE-2026-3854

Platforms (3)

GitHub GitHub.com GitHub Enterprise Server