GitHub Enterprise Server Multiple Vulnerabilities
CSIRTS triage
- What
- Multiple unspecified vulnerabilities in GitHub Enterprise Server.
- Who is affected
- GitHub Enterprise Server deployments running affected versions.
- Urgency
- Severity unknown; requires advisory review to determine impact scope.
- Action
- Obtain full GitHub security advisory to identify vulnerability types, affected versions, and available patches.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Enterprise Server
Get an email when a new Enterprise Server advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.hkcert.org/security-bulletin/github-enterprise-server-multiple-vulnerabilities_20260903
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2023-517642.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 85% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-187300.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-191180.45% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-768510.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2023-51764 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18730 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-19118 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-76851 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Microsoft GitHub Enterprise Server: Multiple vulnerabilitiescert-bund
- unknownCVE-2026-76851: A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server …nvd
- unknownCVE-2026-19118: A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise S…nvd
- unknownCVE-2026-18730: A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server …nvd
- high[NEW] [high] Dovecot: Multiple vulnerabilitiescert-bund
Recent advisories for GitHub Enterprise Server
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Microsoft GitHub Enterprise Server: Multiple vulnerabilitiescert-bund · 2026-09-02
- unknownCVE-2026-76851: A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server …nvd · 2026-09-01
- unknownCVE-2026-19118: A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise S…nvd · 2026-09-01
- unknownCVE-2026-18730: A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server …nvd · 2026-09-01
- unknownCVE-2026-15996: A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an u…nvd · 2026-08-05
- unknownCVE-2026-17556: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unau…nvd · 2026-08-05
More from HKCERT Security Bulletins
- unknownCisco Products Multiple Vulnerabilities2026-09-03
- unknownJenkins Multiple Vulnerabilities2026-09-03
- unknownMozilla Products Multiple Vulnerabilities2026-09-02
- unknownGoogle Chrome Multiple Vulnerabilities2026-09-02
- unknownF5 Products Multiple Vulnerabilities2026-09-02