AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
← CVE index
Δ / VULNERABILITY RECORD

CVE-2026-32631.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSHIGH / 7.4No severity score in this snapshot.
EXPLOITATION STATUSNot listed in the cached KEV catalogThis does not establish absence of exploitation.
RECORD STATUSMicrosoft vendor recordModified Apr 14, 2026

Disclosure summary

CVE-2026-32631 is regarding a vulnerability where it is possible to obtain a user's NTLM hash by tricking them into cloning a malicious repository, or checking out a malicious branch that accesses an attacker-controlled server. By default, NTLM authentication does not need any user interaction. GitHub created this CVE on their behalf. The documented Visual Studio updates incorporate updates in Git which address this vulnerability. Please see CVE-2026-32631 for more information.

Source-reported weakness categories

CWE-359

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

Microsoft Security Updates (CVRF) · 2026-Apr

Open original source · Updated Apr 14, 2026

GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes

Maximum of vendor-reported product scores; products and fixed builds are associations, not a universal affected-version statement.

Microsoft maximum product score: 7.4

VendorProduct / associationVersion / bounds
Microsoft update guideMicrosoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) (MSRC status code 3)
Microsoft update guideMicrosoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) (MSRC status code 3)
Microsoft update guideMicrosoft Visual Studio 2022 version 17.12 (MSRC status code 3)
Microsoft update guideMicrosoft Visual Studio 2022 version 17.14 (MSRC status code 3)
Microsoft update guideMicrosoft Visual Studio 2026 version 18.4 (MSRC status code 3)

Vendor remediation references

  • Release Notes · build 16.11.55 · product IDs 11720
  • Vendor guidance · product IDs 11720
  • Release Notes · build 15.9.79 · product IDs 11600
  • Vendor guidance · product IDs 11600
  • Release Notes · build 17.12.19 · product IDs 12459
  • Vendor guidance · product IDs 12459
  • Release Notes · build 17.14.30 · product IDs 16767
  • Vendor guidance · product IDs 16767
  • Release Notes · build 18.4.4 · product IDs 21166
  • Vendor guidance · product IDs 21166

Original records & references

PUBLISHED 2026-04-14T03:00:00-04:00
MODIFIED 2026-04-14T03:00:00-04:00
INGESTED 2026-10-08T12:45:05-04:00