Red Hat vulnerabilities in CISA KEV
Red Hat has 9 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 30th highest of any vendor. 2 were added in the last 12 months; 4 are linked to known ransomware use (44.4% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 14 to 182), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is JBoss, with 2 entries. Other frequently affected products: Polkit (2); Automatic Bug Reporting Tool (1).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor red-hat --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
9
in CISA KEV
┌─ first added
2021-12-10
earliest entry
┌─ latest added
2026-08-26
most recent entry
┌─ last 12 months
2
entries added
┌─ ransomware use
4 of 9
44.4% linked to ransomware
┌─ distinct products
7
affected products
$ awk -F, {print $1} /var/log/kev/red-hat.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 2 | 1 |
| 2022 | 3 | 3 |
| 2023 | 2 | 0 |
| 2026 | 2 | 0 |
$ sort /var/log/kev/red-hat.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- JBoss 2 entries
- Polkit 2 entries
- Automatic Bug Reporting Tool 1 entry
- JBoss Application Server 1 entry
- JBoss RichFaces Framework 1 entry
$ kev-due-dates --vendor red-hat
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Red Hat
21 days (range 14 to 182)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/red-hat.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (7 of 9 have at least one CWE).
$ grep -ril 'Red Hat' /var/log/news | head -5
Our reporting that names Red Hat or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./red-hat.kev · 9 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2015-3246
Libuser
Red Hat Libuser Race Condition Vulnerability
due 2026-09-09
$ cat CVE-2015-3246.txt
Description. Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2015-5287
Automatic Bug Reporting Tool
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
due 2026-09-09
$ cat CVE-2015-5287.txt
Description. Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2018-14667
JBoss RichFaces Framework
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
due 2023-10-19 · CWE-94
$ cat CVE-2018-14667.txt
Description. Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2021-3560
Polkit
Red Hat Polkit Incorrect Authorization Vulnerability
due 2023-06-02 · CWE-863
$ cat CVE-2021-3560.txt
Description. Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2021-4034
Polkit [RANSOMWARE]
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
due 2022-07-18 · CWE-787
$ cat CVE-2021-4034.txt
Description. The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
Required action. Apply updates per vendor instructions.
- CVE-2010-0738
JBoss [RANSOMWARE]
Red Hat JBoss Authentication Bypass Vulnerability
due 2022-06-15 · CWE-264
$ cat CVE-2010-0738.txt
Description. The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Required action. Apply updates per vendor instructions.
- CVE-2010-1428
JBoss [RANSOMWARE]
Red Hat JBoss Information Disclosure Vulnerability
due 2022-06-15 · CWE-264
$ cat CVE-2010-1428.txt
Description. Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.
Required action. Apply updates per vendor instructions.
- CVE-2010-1871
JBoss Seam 2
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
due 2022-06-10 · CWE-20
$ cat CVE-2010-1871.txt
Description. JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
Required action. Apply updates per vendor instructions.
- CVE-2017-12149
JBoss Application Server [RANSOMWARE]
Red Hat JBoss Application Server Remote Code Execution Vulnerability
due 2022-06-10 · CWE-502
$ cat CVE-2017-12149.txt
Description. The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
Required action. Apply updates per vendor instructions.