CVE-2026-19118Disclosure(github / enterprise_server)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.

github CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-367

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

enterprise_server

Threat summary

3 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 2d ago at 1 mentions (2026-09-03); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

github

Products

enterprise_server

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse3 posts

Carlos Rene@ccerrato14731d
Disclosure
Who fell in: Slack, files leaking out of an RCE. Meta's core product suite, remote code execution. GitHub Enterprise, CVE-2026-19118. Discourse, authenticated RCE. Next.js, an unauthenticated hole in AVIF optimization, tokens and AWS keys and user files sitting right behind it. OpenAI.
Post summary
The tweet discloses multiple disclosed or suspected vulnerabilities across Slack, Meta, GitHub (CVE-2026-19118), Discourse, Next.js, and OpenAI, detailing types such as RCE and AVIF parsing flaws that can leak tokens and files, but offers no PoC, exploit code, patch, or evidence of active exploitation.
10000165
2.7K followersView on X
DailyCVE@dailycve11d
🔴 #GitHub Enterprise Server, Remote Code Execution, #CVE-2026-19118 (High) -DC-Oct2026-2908 https://dailycve.com/github-enterprise-server-remote-code-execution-cve-2026-19118-high-dc-oct2026-2908/
0000032
241 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-19118 A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authe… https://www.cve.org/CVERecord?id=CVE-2026-19118
Post summary
The text reports that CVE‑2026‑19118 is a race‑condition vulnerability in GitHub Enterprise Server that permits remote code execution, with no evidence of active exploitation, PoC, or patch information provided.
000001.3K
58.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	github	enterprise_server	-	-	-

Explore more

Back to dashboard github CVEs enterprise_server vulnerabilities