CVE-2026-62960 git-for-windows CVE debrief

Who should care

Git for Windows users, particularly those using versions prior to 2.55.0.windows.4, should assess exposure and update to the latest version. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure proper mitigation and remediation.

Why it matters

CVE-2026-62960 is a high-severity vulnerability in Git for Windows that allows a malicious remote Git server to expose NTLM authentication material. Git for Windows users should update to version 2.55.0.windows.4 or later to mitigate this vulnerability.

• Potential exposure of NTLM authentication material to attacker-controlled hosts
• Possible unauthorized access to sensitive information
• Required verification of affected systems and user authentication material
• Necessity to update Git for Windows to version 2.55.0.windows.4 or later

Technical summary

A malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection.

Defensive priority

High priority for Git for Windows users to update to version 2.55.0.windows.4

Recommended defensive actions

• Update Git for Windows to version 2.55.0.windows.4 or later
• Review and restrict access to Git repositories
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, which is fixed in Git for Windows version 2.55.0.windows.4. The vulnerability allows a malicious remote Git server to advertise a bundle URI that can cause Windows to initiate an outbound SMB connection, potentially exposing NTLM authentication material. Evidence of exposure should be verified by reviewing system logs and authentication material.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.