Is CVE-2026-1999 actively exploited?

No active exploitation of CVE-2026-1999 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-1999 be exploited remotely?

Yes. CVE-2026-1999 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-1999?

CVE-2026-1999 has a CVSS score of 6.5 (MEDIUM) and an EPSS exploitation probability of 0.03%.

HOME VULNERABILITIESCVE-2026-1999

MEDIUM

CVE-2026-1999

CWE-863Published: February 18, 2026· Updated: Feb 19, 2026

6.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:10.8th

Official Description

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request into a repository without having push access by exploiting an authorization bypass in the enable_auto_merge mutation for pull requests. This issue only affected repositories that allow forking as the attack relies on opening a pull request from an attacker-controlled fork into the target repository. Exploitation was only possible in specific scenarios. It required a clean pull request status and only applied to branches without branch protection rules enabled. This vulnerability affected GitHub Enterprise Server versions prior to 3.19.2, 3.18.5, and 3.17.11, and was fixed in versions 3.19.2, 3.18.5, and 3.17.11. This vulnerability was reported via the GitHub Bug Bounty program.

NVD Source

Technical Analysis

CVE-2026-1999 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 6.5.