Unspecified location – October 19, 2026 -- Wiz Research found a critical vulnerability, CVE-2026-3854, that let any authenticated user execute arbitrary commands on GitHub's backend servers with a single git push command, and 88% of GitHub Enterprise Server instances remained vulnerable at the time of disclosure.

Wiz Research uncovered the flaw on 20 April 2026 in GitHub's internal git infrastructure. It affects both GitHub.com and GitHub Enterprise Server (GHES). The exploit requires only a standard git client.