Red Hat flaws being used in attacks
CISA lists 9 flaws in Red Hat products as being used in attacks, most recently on 26 Aug 2026. 4 have been used in ransomware.
Red HatBeing used in attacks
- On CISA’s list
- 9 flaws, added between 10 Dec 2021 and 26 Aug 2026
- Most recent
- CVE-2015-5287, Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability, added 26 Aug 2026
- Used in ransomware
- 4 flaws, according to CISA
- Products
- JBoss (2), Polkit (2), Automatic Bug Reporting Tool (1), JBoss Application Server (1), JBoss RichFaces Framework (1), and 2 more
What to do
- Update every Red Hat product you use.Install the updates Red Hat offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Red Hat Automatic Bug Reporting Tool
CVE-2015-5287Red Hat Automatic Bug Reporting Tool Privilege Escalation VulnerabilityRed Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Red Hat Libuser
CVE-2015-3246Red Hat Libuser Race Condition VulnerabilityRed Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Red Hat JBoss RichFaces Framework
CVE-2018-14667Red Hat JBoss RichFaces Framework Expression Language Injection VulnerabilityRed Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Red Hat Polkit
CVE-2021-3560Red Hat Polkit Incorrect Authorization VulnerabilityRed Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Red Hat Polkit
CVE-2021-4034Red Hat Polkit Out-of-Bounds Read and Write VulnerabilityThe Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.CISA’s required actionApply updates per vendor instructions. - Red Hat JBoss
CVE-2010-1428Red Hat JBoss Information Disclosure VulnerabilityUnauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.CISA’s required actionApply updates per vendor instructions. - Red Hat JBoss
CVE-2010-0738Red Hat JBoss Authentication Bypass VulnerabilityThe JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.CISA’s required actionApply updates per vendor instructions. - Red Hat JBoss Application Server
CVE-2017-12149Red Hat JBoss Application Server Remote Code Execution VulnerabilityThe JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.CISA’s required actionApply updates per vendor instructions. - Red Hat JBoss Seam 2
CVE-2010-1871Red Hat Linux JBoss Seam 2 Remote Code Execution VulnerabilityJBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Red Hat on CISA’s site.