CVE-2026-62960 git-for-windows CVE debrief

Who should care

Git for Windows users, particularly those who use Git to interact with remote repositories, should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 2.55.0.windows.4 or later, reviewing and restricting access to Git repositories, and monitoring for suspicious Git server activity. Additionally, security teams and vulnerability management teams should review the vulnerability and plan for remediation efforts. Operators and platform administrators should also be aware of the vulnerability and take steps to protect their systems. This vulnerability can have a significant impact on the security of Git for Windows deployments, and users should take immediate action to mitigate the risk. Those who manage Git for Windows deployments should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retested remediated assets, and closed items should be tracked only after evidence is documented. Asset inventory and source tracking are also recommended to ensure the vulnerability is properly managed. Rolling back change windows and implementing additional security measures can also help protect against this vulnerability. Those affected should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. This will help ensure that the necessary steps are taken to mitigate the vulnerability and prevent potential attacks. Overall, a comprehensive approach to mitigating this vulnerability is necessary to ensure the security of Git for Windows deployments. This includes a combination of updating to the latest version, reviewing and restricting access, monitoring for suspicious activity, and implementing additional security measures. By taking these steps, users can help protect their systems from the potential risks associated with this vulnerability. The vulnerability can be mitigated by implementing compensating controls,

Technical summary

A vulnerability in Git for Windows allows a malicious remote Git server to advertise a bundle URI that can cause Windows to initiate an outbound SMB connection, potentially exposing NTLM authentication material to the attacker. The issue is fixed in version 2.55.0.windows.4. Users should prioritize updating to this version to mitigate the vulnerability. Additionally, reviewing and restricting access to Git repositories, monitoring for suspicious Git server activity, and implementing additional security measures to protect against SMB attacks are recommended.

Defensive priority

Git for Windows users should prioritize updating to version 2.55.0.windows.4 to mitigate this vulnerability.

Recommended defensive actions

• Update Git for Windows to version 2.55.0.windows.4 or later
• Review and restrict access to Git repositories
• Monitor for suspicious Git server activity
• Implement additional security measures to protect against SMB attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record indicates that a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host.

Official resources