CVE-2026-32631: 
vulnerability analysis and mitigation

CVE-2026-32631 is an NTLM hash disclosure vulnerability in Git for Windows that allows an attacker to obtain a victim's NTLMv2 hash by tricking them into cloning a malicious repository or checking out a malicious branch that references an attacker-controlled server. The vulnerability was disclosed on April 14–15, 2026, and affects Git for Windows versions prior to 2.53.0(3), as well as Microsoft Visual Studio 2017, 2019, and 2022 (which bundle Git). It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). When a user clones a repository or checks out a branch containing symbolic links that point to network (UNC) paths, Git for Windows follows those symlinks during checkout, causing Windows to transparently initiate NTLM authentication to the attacker-controlled server — without any additional user interaction beyond the initial clone or checkout action. The captured NTLMv2 hash can subsequently be brute-forced offline to recover the user's plaintext credentials. This vulnerability is noted as very similar in impact and context to CVE-2025-66413 (GitHub Advisory, Git for Windows Release).

Successful exploitation results in the disclosure of the victim's NTLMv2 hash to an attacker-controlled server, with a high confidentiality impact and no direct integrity or availability impact. If the captured NTLMv2 hash is successfully brute-forced — which is computationally expensive but feasible — the attacker can recover the user's Windows credentials, potentially enabling lateral movement within a corporate network, pass-the-hash attacks, or unauthorized access to other systems and services authenticated via NTLM (GitHub Advisory, Microsoft MSRC).

The vulnerability requires user interaction (cloning a malicious repository or checking out a malicious branch) but no privileges on the attacker's part, and the NTLM authentication to the attacker's server occurs automatically without further prompting. As of the available data, no public proof-of-concept exploit code or in-the-wild exploitation has been confirmed, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.055%, indicating a low current probability of exploitation in the wild (GitHub Advisory, Feedly).

1. Prepare a malicious repository: The attacker creates a Git repository containing one or more symbolic links that point to a UNC path (e.g., \\attacker-server\share\file) on an attacker-controlled server.
2. Host the repository: The attacker hosts the malicious repository on a public or semi-public platform (e.g., GitHub, GitLab, or a self-hosted Git server) and lures the victim into cloning it, or crafts a malicious branch in a repository the victim already trusts.
3. Set up an NTLM capture server: The attacker runs a tool such as Responder, Impacket's ntlmrelayx, or a custom SMB/HTTP server on the attacker-controlled host to capture incoming NTLM authentication attempts.
4. Victim clones or checks out: When the victim runs git clone <malicious-repo> or git checkout <malicious-branch> on a Windows system with a vulnerable version of Git for Windows, Git follows the symlinks during checkout, causing Windows to automatically initiate NTLM authentication to the attacker's server.
5. Capture NTLMv2 hash: The attacker's server captures the victim's NTLMv2 hash without any further user interaction.
6. Offline brute-force: The attacker uses tools such as Hashcat or John the Ripper to attempt offline brute-forcing of the captured NTLMv2 hash to recover the victim's plaintext credentials (GitHub Advisory, Git for Windows Release).

• Network: Outbound SMB (TCP 445) or HTTP connections from a developer workstation to an unexpected external IP address immediately following a git clone or git checkout operation; NTLM authentication handshakes observed in network traffic destined for non-corporate servers.
• Logs: Windows Security Event Log entries (Event ID 4624/4625) showing NTLM authentication attempts to unfamiliar or external hosts; NTLM operational log entries (Event ID 4024 in audit mode) referencing unexpected target servers.
• Process: git.exe spawning network connections to UNC paths or external SMB endpoints; Windows credential manager activity associated with unexpected network shares.
• File System: Presence of symbolic links within a cloned repository directory pointing to UNC paths (e.g., \\<external-ip>\share\) rather than local paths (GitHub Advisory).

The primary fix is to upgrade Git for Windows to version 2.53.0(3) or later, which prevents git clone from following symbolic links that point to network drives during checkout (Git for Windows Release). Visual Studio 2017, 2019, and 2022 users should apply the April 2026 Patch Tuesday updates, which incorporate the patched Git version (Microsoft MSRC). As a workaround prior to patching, users should only clone repositories or fetch branches from trusted sources. Additionally, organizations can reduce exposure by configuring Windows to restrict or block outbound NTLM authentication to external servers via Group Policy (Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers), or by enabling Windows Credential Guard to protect NTLM credentials (GitHub Advisory).

The vulnerability was covered as part of Microsoft's April 2026 Patch Tuesday, which addressed 167–168 flaws in total, drawing broad coverage from security media including BleepingComputer, The Hacker News, Rapid7, and Zero Day Initiative (BleepingComputer, ZDI, Rapid7). The vulnerability was credited to researcher ph-hitachi and was assigned by GitHub on behalf of the Git for Windows project (GitHub Advisory). Community reaction noted the similarity to prior NTLM hash theft issues in Git (CVE-2025-66413), reflecting ongoing concerns about NTLM's inherent weaknesses and Microsoft's broader initiative to deprecate the protocol.