147
CVEs
12
Critical
63
High
0
KEV
1
PoC
53
Unpatched C/H
17.7%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
12
HIGH
63
MEDIUM
68
LOW
4
Monthly CVE Trend
Affected Products (30)
Red Hat Enterprise Linux 9
354
Red Hat Enterprise Linux 8
348
Red Hat Enterprise Linux 10
317
Red Hat Enterprise Linux 7
302
Red Hat Enterprise Linux 6
252
Red Hat Openshift Container Platform 4
131
Red Hat Build Of Keycloak
91
Red Hat Hardened Images
72
Red Hat Jboss Enterprise Application Platform Expansion Pack
66
Red Hat Single Sign On 7
63
Red Hat Data Grid 8
46
Red Hat Openshift Ai Rhoai
35
Red Hat Advanced Cluster Management For Kubernetes 2
31
Red Hat Directory Server 12
29
Red Hat Directory Server 13
29
Red Hat Directory Server 11
29
Red Hat Satellite 6
23
Red Hat Jboss Enterprise Application Platform 8
23
Kubernetes
22
Red Hat Ansible Automation Platform 2
21
Red Hat Quay 3
20
Red Hat Jboss Enterprise Application Platform 7
15
Multicluster Engine For Kubernetes
13
Red Hat Fuse 7
13
Red Hat Build Of Apache Camel For Spring Boot 4
11
Red Hat Build Of Apache Camel Hawtio 4
10
Red Hat Openshift Update Service
9
Red Hat Process Automation 7
8
Red Hat Openshift Virtualization 4
8
Jwt Attack
7
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-18963 | Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.4% | 71 |
PoC
|
| CVE-2026-67567 | Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2. A low-privileged tenant permitted to create HelmRelease custom resources can abuse the HelmRelease controller, which renders and applies Helm chart templates using its own elevated ServiceAccount, to deploy arbitrary resources anywhere in the cluster and bypass namespace/RBAC boundaries. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.3% | 50 |
No patch
|
| CVE-2026-66792 | Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-privileged user on a managed cluster create a Subscription with crafted annotations that the controller processes with its own elevated Service Account, deploying attacker-chosen resources into arbitrary namespaces. The flaw (CWE-863, CVSS 9.9, scope-changed) affects Red Hat ACM 2.x and Multicluster Global Hub as reported by Red Hat. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.3% | 50 |
No patch
|
| CVE-2026-70496 | Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bound to a ClusterRole with cluster-administrator-equivalent permissions - including user impersonation, RBAC write, Certificate Signing Request approval, and ManifestWork management. An attacker who gains control of the operator's service account (a low-privileged cluster foothold) can leverage these excessive grants to take over the entire hub cluster and its managed clusters. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.9 rating reflects the near-total loss of cluster control if the operator identity is abused. | CRITICAL | 9.9 | 0.3% | 50 |
No patch
|
| CVE-2026-66795 | Privilege escalation in Red Hat Multicluster Engine for Kubernetes (MCE) lets a privileged service account on a managed spoke cluster submit a forged Certificate Signing Request that the managedcluster-import-controller auto-approves, yielding administrative credentials on the central hub cluster. The controller's auto-approval path neither inspects the CSR signer name nor decodes the PEM-encoded x509 request, so an attacker who already controls a spoke can pivot to full control of the hub and, by extension, every cluster it manages. No public exploit identified at time of analysis; EPSS is low (0.22%, 12th percentile) and CISA SSVC records no observed exploitation. | CRITICAL | 9.9 | 0.2% | 50 |
No patch
|
| CVE-2026-18922 | Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remote unauthenticated attackers assume Directory Manager authority without valid credentials. A stale SASL auxiliary identity left over from a failed SASL PLAIN bind is incorrectly installed onto the connection when a later, unrelated bind (e.g. SASL ANONYMOUS) succeeds on the same connection. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivially reproducible bind sequence makes weaponization straightforward. | CRITICAL | 9.8 | 0.6% | 50 |
|
| CVE-2026-78234 | Privilege escalation and cross-service impersonation in Red Hat's hawtio-operator (shipped with Red Hat Build of Apache Camel - Hawtio 4) lets any authenticated user holding namespace 'edit' rights obtain an OpenShift Service-CA-signed client certificate with an attacker-chosen Subject CN. Because the operator reads the Service CA private signing key and mints certificates using a CN supplied in a namespaced Hawtio custom resource - and its ClusterRole aggregates Hawtio CR permissions into the standard edit/admin roles - a low-privileged tenant can forge a certificate that impersonates arbitrary in-cluster service identities (e.g. Jolokia agents) to any component trusting the Service CA for client authentication. No public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 9.9 rating and low attack barrier make it a high-priority patching target. | CRITICAL | 9.9 | 0.2% | 50 |
|
| CVE-2026-76578 | Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine administrators-group membership. The self-managed OTP token ACI does not require authentication and fails to restrict which attributes may be added alongside a token entry; chained with a separately-tracked directory-server ACI evaluation flaw, an unauthenticated LDAP client can create an attacker-controlled Kerberos principal and place it in the administrators group. Assigned CVSS 9.8 (CWE-306, Missing Authentication); no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-12564 | Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list. | CRITICAL | 9.6 | 0.3% | 48 |
No patch
|
| CVE-2026-66794 | Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical). | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-66786 | Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bundled in Red Hat Advanced Cluster Management for Kubernetes 2. The gateway builds its IPsec connection configuration from unvalidated free-form CRD fields, so a malicious member cluster can publish a CableName containing embedded newlines and ipsec.conf directives (e.g. a leftupdown hook) that get executed on the gateway. No public exploit identified at time of analysis; the flaw is reported and tracked by Red Hat. | CRITICAL | 9.1 | 0.7% | 46 |
|
| CVE-2026-71472 | Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privileged tenant escalate to arbitrary code execution inside the cluster's PostgreSQL pod. An authenticated hub administrator or Search Custom Resource editor can supply an unsanitized WORK_MEM value that is passed into both a bash script and an SQL query, breaking out of the intended data plane. No public exploit is identified at time of analysis and the flaw is not on CISA KEV, but the CVSS 9.1 rating reflects full confidentiality, integrity, and availability loss with a scope change. | CRITICAL | 9.1 | 0.4% | 46 |
No patch
|
| CVE-2026-86404 | Unrestricted Java deserialization in Red Hat EAP's embedded Apache ActiveMQ Artemis broker allows authenticated JMS clients to achieve remote code execution by sending crafted ObjectMessage payloads. The flaw stems from a logical inversion in the allow-list guard: when no allow-list is configured (the default), `isTrustedType()` unconditionally returns true, rendering the entire class-filtering mechanism inoperative. Affected products include Red Hat AMQ Broker 7, JBoss EAP 7 and 8, and Red Hat builds of Apache Camel - all widely deployed in enterprise Java environments. No public exploit or KEV listing has been identified at time of analysis, but deserialization gadget chains targeting common Java libraries are extensively documented. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-12894 | Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attackers with the ability to influence template content to bypass Java sandbox restrictions and execute arbitrary OS commands on the server. Affected Red Hat products include Red Hat Build of Quarkus, Red Hat Build of Apache Camel 4 for Quarkus 3, and the JBoss EAP Expansion Pack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the CVSS score of 8.8 and full C/I/A impact make this a high-priority patching target for any Quarkus deployment exposing user-influenced template rendering. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-83596 | Memory corruption via classic buffer overflow in WebKitGTK allows remote attackers to achieve full code execution by delivering malicious web content to a victim user. Affecting Red Hat Enterprise Linux versions 6 through 9, the vulnerability requires no authentication and no special configuration - only that a user process attacker-controlled web content through a WebKitGTK-based application. No public exploit has been identified at time of analysis, but the CVSS 8.8 High rating and full CIA triad impact make this a high-priority patching target across the affected RHEL fleet. | HIGH | 8.8 | 0.3% | 44 |
No patch
|