GitHub Enterprise Server CVE-2026-4821

Exploitation requires (1) network or local access to the GitHub Enterprise Server instance's Management Console and (2) Management Console administrator privileges - this is not a pre-authentication or standard-user issue. The concrete trigger is entering shell metacharacters into a proxy configuration field such as http_proxy in the Management Console settings; the vulnerable code path is reached only when such a proxy value is submitted and processed. Limiting factors that reduce realistic risk: the attacker must already hold the highest administrative role on the appliance (PR:H), there is no remote unauthenticated path (AV:L, UI:N), and it affects instances running any version prior to the fixed releases. Because a Management Console admin is already a highly trusted operator, the practical significance is a privilege-boundary escape from console administration to arbitrary OS command execution.

Signals are consistent and point to a real-but-gated risk rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, VI:H/SI:H, other impacts N) scores 8.1 and requires local access plus high privileges (Management Console administrator), which is a significant barrier. EPSS is 0.01% (3rd percentile) and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: partial - all reinforcing low near-term exploitation likelihood. There is no KEV listing and no public exploit identified. The tension worth noting: the vendor vector marks confidentiality and availability as None and only integrity/system-integrity as High, which understates the practical outcome - arbitrary OS command execution typically enables full read, tamper, and disruption of the appliance, so real-world technical impact is likely higher than the vector's C:N/A:N implies. Net priority: patch on a normal-to-expedited cadence; it is a meaningful post-compromise escalation and insider-abuse vector, not an internet-facing worm risk.

An attacker who has obtained Management Console administrator access - for example a rogue insider, or an external attacker who phished or reused stolen console credentials - logs into the console, opens the proxy configuration, and enters a value like http://proxy;<malicious command> into the http_proxy field. When the instance processes the setting, the injected shell metacharacters cause the payload to execute as an OS command on the appliance, giving the attacker code execution beyond the intended console boundary. No public exploit code is currently identified, and the attack requires the high-privilege console access described by the CVSS local/PR:H vector.