Red Hat Satellite EUVD-2026-40959

Exploitation requires an authenticated Foreman/Red Hat Satellite 6 account that has been granted usergroup-management permissions (the specific delegated capability to create or modify user groups); with that, the attacker attaches an arbitrary higher-privileged role - up to the administrator role - to a group and adds themselves as a member. Limiting factors: it is not exploitable by anonymous or fully unprivileged users (CVSS PR:L confirms some privilege is needed), there is no path for a user lacking usergroup-management rights, and it depends on Foreman's RBAC delegation being in use. No special feature toggle or non-default configuration beyond having delegated the usergroup-management permission is required, and no victim interaction is needed (UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity attack requiring some existing authentication and no user interaction, with total confidentiality/integrity/availability impact consistent with full admin takeover. The key limiting factor is PR:L: the attacker must already be an authenticated user delegated usergroup-management permissions, so this is insider or post-compromise privilege escalation rather than an anonymous internet attack. No EPSS score, SSVC decision, KEV entry, or POC was provided in the intelligence, so exploitation probability cannot be quantified from the data, and the absence of a KEV listing means active exploitation is unconfirmed. Net: a genuine high-priority issue in environments that delegate user-group administration to non-admins, but gated by that prerequisite permission rather than being a wormable network flaw. Missing signals (EPSS, POC status) should be treated as unknown, not as evidence of low risk.

An administrator delegates day-to-day user-group management to a help-desk operator via a limited role that includes usergroup-management permissions. That operator creates or edits a user group, attaches the built-in administrator role to it (which the platform fails to reject), adds their own account as a member, and immediately inherits full Satellite administrator privileges. No interaction from a real admin and no additional exploit tooling are required, though the attacker must already hold the delegated permission.