CVE-2026-77987: GitHub Enterprise Server remote code execution (CVSS 9.8)

Description

A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

GitHub Enterprise Server≥ 3.17.0 < 3.17.21 · ≥ 3.18.0 < 3.18.15 · ≥ 3.19.0 < 3.19.12 · ≥ 3.20.0 < 3.20.8

Remediation

Fixed in

GitHub Enterprise Server≥ 3.17.21

Patch & vendor advisories

References

https://docs.github.com/en/[email protected]/admin/release-notes#3.17.21Release NotesVendor Advisory
https://docs.github.com/en/[email protected]/admin/release-notes#3.18.15Release NotesVendor Advisory
https://docs.github.com/en/[email protected]/admin/release-notes#3.19.12Release NotesVendor Advisory
https://docs.github.com/en/[email protected]/admin/release-notes#3.20.8Release NotesVendor Advisory
https://docs.github.com/en/[email protected]/admin/release-notes#3.21.6Release NotesVendor Advisory
https://docs.github.com/en/[email protected]/admin/release-notes#3.22.1Release NotesVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-77987 being actively exploited?

CVE-2026-77987 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.68%.

How severe is CVE-2026-77987?

CVE-2026-77987 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.68% probability of exploitation.

Which products are affected by CVE-2026-77987?

Affected products include GitHub Enterprise Server.

How do I fix CVE-2026-77987?

Upgrade affected software to a fixed version, for example GitHub Enterprise Server 3.17.21 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-77987 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo