CVE-2026-3854: GitHub Enterprise Server RCE — 88% of Self-Hosted Instances Still Unpatched

Any authenticated user on a vulnerable GitHub Enterprise Server instance can execute arbitrary commands on the backend with a single git push. That’s CVE-2026-3854, a CVSS 8.7 remote code execution flaw disclosed publicly on April 28, and 88% of self-hosted GHES installations were still running vulnerable versions when researchers published the data.

How it works

During a git push, clients can pass key-value “push options” to the remote. GitHub Enterprise Server took those values and embedded them directly in internal service headers before routing the request — without sanitizing the input. By injecting newlines or control characters into a push option value, an authenticated attacker could overwrite header fields, pivot the request to unintended internal endpoints, and ultimately land arbitrary command execution on the GHES backend.

A single git push --push-option='injected-value' was enough. No secondary exploit, no privilege escalation step. One request, full backend access.

Discovery and timeline

Wiz Research discovered the flaw on March 4, 2026 and reported it to GitHub the same day. GitHub deployed a silent fix to GitHub.com within hours. CVE-2026-3854 was formally assigned on March 10 along with patched GHES releases. Public disclosure happened on April 28 — 55 days after the fix landed — following a coordinated disclosure window.

GitHub’s own forensic investigation found no evidence of exploitation in the wild before disclosure. All anomalous activity in logs was traced back to Wiz researchers’ testing environment.

Affected and fixed versions

GHES 3.14 through 3.19 are affected. Patched versions:

Branch	Fixed version
3.14	3.14.24
3.15	3.15.19
3.16	3.16.15
3.17	3.17.12
3.18	3.18.6
3.19	3.19.3

Instances running versions older than 3.14 are beyond end-of-life and should be upgraded to a current branch immediately regardless.

What to do right now

Check your version from the GHES admin shell: ghe-config --get github.version or via the Settings → Maintenance page in the admin console. If you’re below any fixed version in the table above, upgrade. GitHub’s upgrade documentation is at docs.github.com/en/enterprise-server.

The 88% unpatched figure is damning. Patches shipped March 10 — that’s seven weeks of exposure for the overwhelming majority of self-hosted instances. If your organization runs GHES for internal code hosting, this is a fire drill.

GitHub.com itself was never vulnerable after March 4. The risk is entirely on teams running self-hosted Enterprise Server.

Severity context

CVSS 8.7 lands in the “High” tier, not Critical, primarily because authentication is required — an unauthenticated path would push this to a 9.x. In practice, the bar for authentication on most GHES instances is any employee with a company login, which makes the effective blast radius close to what you’d see from a Critical unauthenticated flaw in an enterprise context.

For teams hosting proprietary code, internal tooling, or regulated data on GHES, the patch is non-negotiable.