CVE-2024-0200: GitHub Enterprise Server unsafe reflection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCritical CVSS (9.8) and very high EPSS, but exploitation requires a privileged organization owner account, which limits reachability.

What it is

GitHub Enterprise Server contains an unsafe reflection flaw (CWE-470) that allows reflection injection, letting an attacker execute user-controlled methods and achieve remote code execution. All versions prior to 3.12 are affected; fixes are available in 3.8.13, 3.9.8, 3.10.5 and 3.11.3. The flaw matters because it gives code execution on a self-hosted source control platform that typically holds sensitive code and credentials.

Impact

An attacker gains remote code execution on the GHES instance, allowing arbitrary commands and access to hosted repositories, credentials and configuration.

Attack surface

Reached over the network through the GHES web interface; the description states the actor must be logged in with the organization owner role, so valid privileged authentication is required and no user interaction is indicated. Note the CVSS vector lists PR:N, which conflicts with the stated organization owner requirement.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high (0.717, 99.4th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade to GHES 3.8.13, 3.9.8, 3.10.5 or 3.11.3 (or 3.12 or later) immediately.
• Restrict and audit organization owner accounts; enforce least privilege and strong authentication for privileged roles.
• Limit network exposure of the GHES management and web interfaces to trusted networks.
• Monitor privileged account activity and review logs for unexpected method invocation or command execution.

Detection

• Alert on anomalous activity from organization owner accounts, especially outside normal hours or from new source IPs.
• Review GHES application and system logs for unexpected process or command execution on the appliance.
• Hunt for reflection-style injection patterns in requests to GHES endpoints from privileged sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.