CVE-2026-19118
GitHub Enterprise Server
A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.
Ransomware groups exploiting CVE-2026-19118
Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims
Exploitation is attributed to these groups across their recorded activity. It does not follow that every organisation they listed was reached through CVE-2026-19118 — the source data does not record an entry point per incident.
Exploitation status
EPSS — exploitation probability
FIRST puts the probability of exploitation activity in the next 30 days at 0.9%, which is higher than 60.2% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Recent listings by these groups
Disclosures from the groups above, newest first.
Frequently asked questions
Is CVE-2026-19118 being exploited by ransomware groups?
Yes. CVE-2026-19118 is recorded as exploited by Payload. Between them these groups account for 93 victim disclosures in this database.
What does CVE-2026-19118 affect?
CVE-2026-19118 affects GitHub Enterprise Server. A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.
How severe is CVE-2026-19118?
CVE-2026-19118 is rated HIGH with a CVSS base score of 7.5. EPSS puts the probability of exploitation in the next 30 days at 0.9%, higher than 60.2% of all scored vulnerabilities. It is not currently in the CISA Known Exploited Vulnerabilities catalog.
How should organisations respond to CVE-2026-19118?
Apply the vendor patch for GitHub Enterprise Server as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.