Is CVE-2026-1355 actively exploited?

No active exploitation of CVE-2026-1355 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-1355 be exploited remotely?

Yes. CVE-2026-1355 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-1355?

CVE-2026-1355 has a CVSS score of 6.5 (MEDIUM) and an EPSS exploitation probability of 0.06%.

HOME VULNERABILITIESCVE-2026-1355

MEDIUM

CVE-2026-1355

CWE-862Published: February 18, 2026· Updated: Feb 19, 2026

6.5

CVSS v3.1

EPSS:0.09%probability of exploitation in 30 daysPercentile:26.4th

Official Description

A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s repository migration export due to a missing authorization check in the repository migration upload endpoint. By supplying the migration identifier, an attacker could overwrite or replace a victim’s migration archive, potentially causing victims to download attacker-controlled repository data during migration restores or automated imports. An attacker would require authentication to the victim's GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.20 and was fixed in versions 3.19.2, 3.18.5, 3.17.11, 3.16.14, 3.15.18, 3.14.23. This vulnerability was reported via the GitHub Bug Bounty program.

NVD Source

Technical Analysis

CVE-2026-1355 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 6.5.