CVE-2024-23854
📛 CVE Title
CVE-2024-23854
Description
No English description in the CVE record.
Overview
- State
- REJECTED
- Assigner (CNA)
- INCIBE
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- no score available from CNA, NVD, or AI yet
- CWE(s)
- —
- Reserved
- 2024-01-23
- Published
- —
- Last updated
- 2024-01-23 16:25 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/23xxx/CVE-2024-23854.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2024-01-23 16:15:49 UTC
- NVD last modified
- 2024-01-23 16:15:49 UTC
NVD / KEV / EPSS data refreshed 2026-08-17 03:57 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
AI-forensic CVSS estimate
Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.
No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:nvd.nist.gov
The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...
2026-05-23 05:41 UTC -
web:thecodersblog.com
The Patch and Mitigation : GitHub's Response and Developer Actions GitHub's Remediation Upon receiving the bug bounty report from Wiz researchers on March 4, 2026, GitHub acted rapidly. Within hours, they validated the finding, identified the root cause, and deployed a fix to GitHub.com and Enterprise Cloud environments.
2026-05-23 05:41 UTC -
web:thecyberexpress.com
CVE -2026-3854 RCE vulnerability in GitHub Enterprise Server lets attackers run code via git push. Patch now to secure affected systems.
2026-05-23 05:41 UTC -
web:thehackernews.com
CVE -2026-3854 (CVSS 8.7) enabled GitHub RCE via git push, risking cross-tenant access to millions of repositories.
2026-05-23 05:41 UTC -
web:www.bleepingcomputer.com
In early March, GitHub patched a critical remote code execution vulnerability ( CVE -2026-3854) that could have allowed attackers to access millions of private repositories.
2026-05-23 05:41 UTC -
web:www.helpnetsecurity.com
Wiz researchers discovered CVE -2026-3854 in GitHub Enterprise Server, a self-hosted version of GitHub for orgs that need the option.
2026-05-23 05:41 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-23 05:41 UTC -
web:www.secure.com
A critical GitHub vulnerability let any authenticated user run code on backend servers with a single git push, exposing millions of private repositories.
2026-05-23 05:41 UTC -
web:www.thetechedvocate.org
Spread the loveIntroduction In recent weeks, the cybersecurity community was rocked by the revelation of a critical vulnerability in GitHub's infrastructure, identified as CVE -2026-3854. This flaw, discovered by researchers at Wiz, has raised alarms over the security of millions of repositories hosted on GitHub.com and GitHub Enterprise Server. With the potential for remote code execution ...
2026-05-23 05:41 UTC -
web:www.wiz.io
Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server ( CVE -2026-3854) Details on CVE -2026-3854: A critical flaw in GitHub's internal git infrastructure enabling RCE on GitHub.com and GitHub Enterprise Server.
2026-05-23 05:41 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2024-23854.json.
{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2024-01-23T15:25:23.427Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE ID was unused by the CNA."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2024-23854",
"dateRejected": "2024-01-23T15:25:23.427Z",
"dateReserved": "2024-01-23T10:54:26.509Z",
"dateUpdated": "2024-01-23T15:25:23.427Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.0"
}