CVE-2026-77987Patch(github / enterprise_server)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch github enterprise_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.

github CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-208CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

enterprise_server

Threat summary

Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 7 signals
Disclosure: 2 classified signals
Peaked 3d ago at 2 mentions (2026-09-23); latest day: 1
7 total mentions across 5 days

Affected systems

Vendors

github

Products

enterprise_server

Deep dive

Activity timeline7 mentions / 5d

Signal classification2 categories

Patch

571.4%

Disclosure

228.6%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-22	1	Disclosure1
2026-09-23	2	Patch2
2026-09-24	2	Patch2
2026-09-30	1	Disclosure1
2026-10-05	1	Patch1

Full discourse7 posts

Seokchan Yoon / 윤석찬@_seokchan_yoon38d
Disclosure
The CRITICAL SSRF vulnerability I found in @github Enterprise Server was just publicly disclosed! > CVE-2026-77987 < By chaining the SSRF with a timing side channel, I was able to extract an instance secret and ultimately achieve RCE on the instance. Thanks to @GitHubSecurity for their professional work 🔥
Post summary
The tweet discloses CVE-2026-77987, a critical SSRF in GitHub Enterprise Server, and details a timing side-channel exploit chain that extracts instance secrets and enables RCE, but provides no patch, tool, or active exploitation in the wild claims.
1004071.5K
832 followersView on X
Dark Web Intelligence@DailyDarkWeb45d
Patch
🚨 GITHUB ENTERPRISE SERVER CRITICAL: NOTEBOOK VIEWER SSRF TO RCE (CVE-2026-77987) GitHub released Enterprise Server 3.22.1 (and matching fixes on 3.21–3.17) on September 22, 2026 with a Critical security fix. Lead Critical issue (CVSS 9.3): * CVE-2026-77987 — notebook viewer SSRF: scheme/host were validated but an explicit port was not, so an attacker with network access could reach co-located internal services. Response timing acted as an oracle to extract instance secrets, which could then be used to obtain remote code execution on the appliance. Unauthenticated when private mode is disabled; any authenticated user when private mode is enabled. Also in the same release: High stored XSS via crafted Markdown HTML attribute injection (CVE-2026-77912), plus additional Packages upload-auth and stafftools token hardening. Fixed in: 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, 3.17.21. Self-managed GHES admins should upgrade promptly. ⚠️ Analyst Note: This is an official GitHub Enterprise Server Critical release-note fix, not a dark-web leak claim and not a CISA KEV add as of our check. No confirmed in-the-wild exploitation is claimed in the vendor notes reviewed here (CISA-ADP SSVC: Exploitation none). Credit: Seokchan Yoon (R31n) via GitHub Bug Bounty. Primary: https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.1 #DDW #DarkWeb #GitHub #GHES #CVE202677987 #SSRF #RCE #ThreatIntelligence #CyberSecurity
Post summary
This post discloses CVE-2026-77987 with detailed technical analysis and CVSS 9.3 scoring, while primarily directing users to upgrade to fixed GitHub Enterprise Server versions (3.22.1+). It explicitly clarifies that no PoC or in-the-wild exploitation exists as of the report.
1202367.3K
209.0K followersView on X
Upwind Security MDR@UpwindMDR45d
Patch
🚨Critical - GitHub Enterprise Server Notebook Viewer SSRF Port Bypass (CVE-2026-77987) GitHub Enterprise Server notebook viewer validates scheme+host on a user-supplied URL but fails to validate the port, enabling SSRF to internal services on alternate ports. While bodies aren’t returned, response timing acts as an oracle to leak instance secrets char-by-char, enabling follow-on RCE via internal services. 👉Affected: GitHub Enterprise Server 3.17.0-3.22.0 | Upgrade to 3.17.21/3.18.15/3.19.12/3.20.8/3.21.6/3.22.1
Post summary
The text details a critical SSRF vulnerability in GitHub Enterprise Server (CVE-2026-77987) that can lead to RCE, and explicitly provides specific upgrade versions for users to patch the issue.
2000076
309 followersView on X
CCB Alert@CCBalert45d
Patch
Warning: Critical CVE-2026-77987 (CVSS 9.3) affects GitHub Enterprise Server, allowing attackers to exploit an SSRF vulnerability, potentially leading to remote code execution. Advisory: https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.1 #Patch #Patch #Patch
Post summary
The post discloses a critical SSRF vulnerability (CVE-2026-77987) in GitHub Enterprise Server with a CVSS 9.3 rating and directs users to a vendor advisory for patching to version 3.22.1.
01010321
7.3K followersView on X
takenaka hiroya@Joe_Biden_ja33d
Patch
GitHub Enterprise Server に SSRF（CVE-2026-77987・CVSS 9.8）。ノートブックビューアがポートを検証せず内部サービスへ要求が通り、応答時間から秘密情報を抜かれ RCE に至る。3.17〜3.22 が対象、修正版へ更新を。 https://cve.autoarticles.net/cve/CVE-2026-77987
Post summary
The post discloses CVE-2026-77987, an SSRF leading to RCE in GitHub Enterprise Server with CVSS 9.8, and advises updating affected versions 3.17–3.22 to a patched version.
0000052
557 followersView on X
sunil kumawat@Sunil_kumawat1744d
Patch
@UpwindMDR CVE-2026-77987 (GHES notebook viewer): SSRF checked scheme/host but not port. Timing oracle can leak instance secrets → follow-on RCE. Unauth if private mode off. Patch 3.17.21/3.18.15/3.19.12/3.20.8/3.21.6/3.22.1.
Post summary
This tweet discloses CVE-2026-77987, an SSRF vulnerability in GHES notebook viewer that can lead to RCE via a timing oracle, and directly names multiple patched versions as remediation. The primary focus is on the availability of fixes.
0000026
23 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-77987 A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and hos… https://www.cve.org/CVERecord?id=CVE-2026-77987
Post summary
The text is a brief disclosure of CVE-2026-77987, an SSRF vulnerability in GitHub Enterprise Server's notebook viewer, with some technical detail but no mention of PoC, exploit, patch, or active exploitation. The truncated text limits full assessment.
00000880
58.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	github	enterprise_server	-	-	-

Explore more

Back to dashboard github CVEs enterprise_server vulnerabilities

What researchers are saying

CVE-2026-77987

Seokchan Yoon / 윤석찬[verified]@_seokchan_yoonDisclosure

The tweet discloses CVE-2026-77987, a critical SSRF in GitHub Enterprise Server, and details a timing side-channel exploit chain that extracts instance secrets and enables RCE, but provides no patch, tool, or active exploitation in the wild claims.

Dark Web Intelligence[verified]@DailyDarkWebPatch

This post discloses CVE-2026-77987 with detailed technical analysis and CVSS 9.3 scoring, while primarily directing users to upgrade to fixed GitHub Enterprise Server versions (3.22.1+). It explicitly clarifies that no PoC or in-the-wild exploitation exists as of the report.

Upwind Security MDR[verified]@UpwindMDRPatch

The text details a critical SSRF vulnerability in GitHub Enterprise Server (CVE-2026-77987) that can lead to RCE, and explicitly provides specific upgrade versions for users to patch the issue.

CCB Alert@CCBalertPatch

The post discloses a critical SSRF vulnerability (CVE-2026-77987) in GitHub Enterprise Server with a CVSS 9.3 rating and directs users to a vendor advisory for patching to version 3.22.1.

takenaka hiroya@Joe_Biden_jaPatch

The post discloses CVE-2026-77987, an SSRF leading to RCE in GitHub Enterprise Server with CVSS 9.8, and advises updating affected versions 3.17–3.22 to a patched version.

sunil kumawat@Sunil_kumawat17Patch

This tweet discloses CVE-2026-77987, an SSRF vulnerability in GHES notebook viewer that can lead to RCE via a timing oracle, and directly names multiple patched versions as remediation. The primary focus is on the availability of fixes.

CVE@CVEnewDisclosure

The text is a brief disclosure of CVE-2026-77987, an SSRF vulnerability in GitHub Enterprise Server's notebook viewer, with some technical detail but no mention of PoC, exploit, patch, or active exploitation. The truncated text limits full assessment.