If your teams use Git on Windows to clone, fetch, or synchronize source code, CVE-2026-62960 deserves immediate attention. The flaw can allow a malicious or compromised Git server to cause a developer's Windows workstation to send authentication material to an attacker-controlled system. That material may then be used to recover the user's password and move deeper into your environment.
This issue is especially relevant to software teams, managed service providers, enterprises with internal development teams, and any organization where developers connect to external repositories. It does not require an attacker to compromise the workstation directly; a convincing repository or server interaction can be enough.
This post explains the vulnerability in business terms, identifies the organizations most at risk, provides practical scenarios, and gives security and IT teams a clear path to detection, remediation, and longer-term risk reduction.
CVE-2026-62960 affects Git for Windows, the widely used Windows distribution of the Git version-control system. GitHub published the vulnerability on August 21, 2026, and assigned it a CVSS 3.1 base score of 7.4, placing it in the High severity range.
In plain language, the flaw involves how Git for Windows handles a special instruction called a bundle URI. When certain settings are enabled, a remote Git server can tell the client to retrieve a bundle from another location. In vulnerable versions, that location could be a Windows network path. Windows may then automatically attempt to authenticate to that path, potentially exposing NTLM authentication material to the server's operator.
The issue was fixed in Git for Windows version 2.55.0.windows.4. GitHub's advisory, release notes, and corrective commit are the primary vendor references, and the National Vulnerability Database lists the affected product as Git for Windows versions before that fixed release.
For a business, the central risk is credential exposure. A developer who clones or fetches from a malicious repository could unknowingly allow their Windows credentials to be captured. If those credentials belong to a domain account, an attacker may be able to crack the captured authentication material and use the recovered password to access email, file shares, cloud resources, VPNs, or internal applications.
Operational impact can be significant. Development teams often have broad access to source code, build systems, deployment pipelines, and production configuration. A compromised developer account can therefore become a pathway to intellectual property theft, malicious code changes, ransomware deployment, or supply-chain compromise.
Data and reputation risks follow directly. Exposure of proprietary source code, customer data, credentials, or internal documentation can trigger customer notifications, contractual issues, regulatory scrutiny, and loss of trust. Organizations in healthcare, financial services, government contracting, and other regulated sectors may also face compliance obligations if authentication material or sensitive systems are affected.
The good news is that the vulnerability has a vendor fix and a narrow set of preconditions. Businesses that inventory Git installations, update Windows development endpoints, restrict risky Git settings, and monitor for suspicious outbound connections can reduce exposure quickly.
Software Company With Remote Developers: A distributed software firm relies on contractors who clone repositories from multiple external sources. A contractor clones a seemingly legitimate open-source project from an attacker-controlled server, causing their Windows workstation to authenticate to the attacker's system. The attacker recovers the contractor's password and uses it to access the company's code repository and continuous integration environment.
Regional Bank: A regional bank's internal development team uses Git for Windows on corporate laptops. An employee fetches updates from a compromised third-party dependency mirror. Because the employee uses a privileged domain account, the exposed credentials could provide a path toward internal file shares, administrative systems, or sensitive customer-data environments.
Managed Service Provider: A managed service provider maintains client infrastructure and uses Git to manage automation scripts and configuration repositories. A technician's credentials are exposed through the vulnerability. Because the same account may be used across several client environments, the provider faces potential cross-client impact, contractual liability, and urgent credential-reset work.
Small E-Commerce Business: A small e-commerce company has one developer who manages its online store, integrations, and deployment scripts. The developer clones a plugin or template repository found through a search engine. Even without a large IT team, the business could lose control of its storefront code, payment-integration settings, or customer records if the exposed credentials lead to broader account compromise.
git clone or git fetch.transfer.bundleuri=true, either globally, per repository, or through managed configuration.If your organization uses Git on Windows, do not wait for a suspicious login to discover whether this vulnerability affects you. IntegSec can help you identify exposed endpoints, validate your remediation, test credential-exposure pathways, and strengthen the controls that prevent similar attacks. Visit https://integsec.com to schedule a penetration test and take a practical, business-focused approach to reducing cybersecurity risk.
CVE-2026-62960 is an information-disclosure weakness in Git for Windows caused by inadequate validation of server-advertised bundle URIs. In affected versions before 2.55.0.windows.4, a remote Git server can advertise a bundle URI during git clone or git fetch when transfer.bundleuri=true. The URI is processed through transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c.
The root cause is that non-HTTP and non-HTTPS values are treated as local filesystem paths, while file:// prefixes are stripped. As a result, a bare UNC path or file:// URI pointing to an attacker-controlled SMB share causes Windows to initiate an outbound SMB connection. Windows may transparently perform NTLM authentication, exposing NTLM authentication material, including an NTLMv2 hash, to the attacker-selected host.
The attack vector is network-based, requires user interaction in the form of a clone or fetch, requires no privileges, and has low attack complexity. GitHub assigned CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, with a base score of 7.4 High. The associated weaknesses are CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, and CWE-610, Externally Controlled Reference to a Resource in Another Sphere.
Version enumeration commands:
Scanner signatures: Vulnerability scanners should flag Git for Windows installations reporting versions below 2.55.0.windows.4. Tenable classifies the issue as High and tracks the affected product range as Git for Windows prior to 2.55.0.windows.4.
Log indicators: Review Git client logs, endpoint telemetry, and proxy or firewall records for clone or fetch activity followed by unexpected SMB connections. Pay particular attention to outbound TCP 445 traffic from developer endpoints to unfamiliar external IP addresses, especially shortly after Git operations.
Behavioral anomalies: Look for git.exe or related Git processes initiating SMB connections, unusual NTLM authentication events, authentication attempts to non-corporate hosts, and developer accounts authenticating from unexpected systems or locations.
Network exploitation indicators: Suspicious indicators include UNC paths or file:// URIs in bundle URI configuration, outbound SMB sessions to attacker-controlled infrastructure, and NTLM authentication material observed leaving the corporate network.
transfer.bundleuri=true where business operations allow: transfer.bundleuri, UNC paths, and file:// references. Reset credentials for users who cloned or fetched from untrusted repositories while running a vulnerable version, prioritizing domain, administrative, and privileged service accounts. Review authentication logs, identity-provider sign-in records, VPN logs, and endpoint detection alerts for evidence of abnormal NTLM activity or follow-on access. Communicate clear guidance to developers: avoid cloning from untrusted sources, verify repository URLs, and report unexpected authentication prompts or network activity.transfer.bundleuri unless a documented business need requires it, and review the setting across system, global, and repository scopes.