Vulnerabilities

Red Hat's Polkit (PolicyKit), the component that enforces authorization policy for privileged D-Bus requests, fails to correctly verify credentials for D-Bus requests: when the calling client drops its connection before the authorization check completes, Polkit treats the request as if it came from a privileged process. A local, unprivileged user can trigger this by initiating a D-Bus call to a system service and terminating the connection at the right moment, making the race straightforward to hit with repeated attempts. A successful exploit bypasses the credential check and escalates the attacker's privileges to root on the affected host. Any Red Hat system shipping the vulnerable Polkit build is affected, and no public proof-of-concept is documented. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2023-05-12), which indicates known exploitation in the wild, though ransomware use is unknown.

Do: Apply updated Polkit packages per Red Hat's advisory instructions on all affected systems, and verify the running Polkit version matches the vendor's fixed release. Because the flaw is CISA KEV-listed with a 22.2% EPSS, prioritize patching on multi-user and internet-exposed hosts; where patching is delayed, restrict local shell access to untrusted users, since the flaw requires local access to trigger.

CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host.

Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use.

RichFaces 3.x through 3.3.4, Red Hat's legacy JavaServer Faces (JSF) component framework, is vulnerable to unauthenticated Expression Language (EL) injection (CWE-94) in the UserResource resource. A remote attacker sends crafted requests to UserResource (org.ajax4jsf.resource.UserResource$UriData), causing the framework to evaluate attacker-controlled EL built from chains of Java serialized objects. Successful exploitation results in arbitrary code execution with the privileges of the affected Java application server, with no authentication or user interaction required (CVSS 3.1: 9.8). Any application or product deploying RichFrames 3.x — including deployments in Red Hat's JBoss/Enterprise Linux ecosystem — is affected, and since RichFrames 3.x is end-of-life many installations remain unpatched. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2023-09-28, confirming exploitation in the wild, and EPSS places it in the 99th percentile with a 74.2% probability of exploitation within 30 days.

Do: Prioritize remediation given the KEV listing: apply mitigations or updated packages per Red Hat's vendor instructions, or discontinue/replace RichFrames 3.x (end-of-life) where fixes are unavailable, per CISA's required action. Inventory Java web applications for RichFrames 3.x usage (org.ajax4jsf / a4j components), focusing on internet-facing servers, and restrict access to UserResource endpoints if code updates are not immediately possible.

CVE-2017-12149 is a critical (CVSS 9.8) unauthenticated deserialization flaw in the doFilter method of the ReadOnlyAccessFilter of the HTTP Invoker in JBoss Application Server as shipped with Red Hat Enterprise Application Platform 5.2 (CWE-502). Because the filter does not restrict which classes it will deserialize, a remote, unauthenticated attacker can send crafted serialized data to the HTTP Invoker endpoint over the network and have the server deserialize it. Successful exploitation yields arbitrary code execution with the privileges of the JBoss server process, giving attackers a foothold for full system compromise. Any organization running the affected JBoss Application Server/EAP 5.2 with the HTTP Invoker enabled is affected. The flaw is actively exploited: it is in CISA's Known Exploited Vulnerabilities Catalog (added 2021-12-10) with known ransomware use, EPSS estimates a 90.7% chance of exploitation within 30 days, and reporting links it to campaigns by the ChamelGang APT group against energy and aviation targets.

Do: Per the KEV required action, apply the vendor's updates to Red Hat JBoss EAP following Red Hat's instructions. As an interim mitigation, restrict or remove access to the HTTP Invoker endpoints (for example, block or firewall the invoker paths so they are not reachable by untrusted clients). Prioritize patching on internet-facing JBoss servers and hunt for signs of exploitation, given the known ransomware use.

The default block on unauthenticated access to the JBoss Application Server Web Console (/web-console) is incomplete: it only restricts the GET and POST HTTP verbs. A remote, unauthenticated attacker can therefore send requests using other HTTP verbs to bypass the access control and retrieve sensitive information exposed by the web console. Any deployment of affected Red Hat JBoss releases in which the web console is reachable, especially internet-exposed instances relying on the default block, is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-25 with known ransomware use, indicating active exploitation, though no public proof-of-concept is known and CVSS scoring is still pending.

Do: Apply updates per the vendor's instructions, as required by CISA's KEV listing. As interim mitigation, ensure /web-console enforces authentication for all HTTP methods, restrict or filter non-GET/POST verbs at a reverse proxy or firewall, or remove internet exposure of the web console. Review logs for non-GET/POST requests to /web-console, given known ransomware use.

CVE-2015-3246 is a race condition in Red Hat's libuser, the user-management library used by utilities that modify system accounts, that can cause corruption of the /etc/passwd file during concurrent account updates. An authenticated local user who triggers the race — typically by racing account-modification operations against one another — can desynchronize or corrupt the passwd file. Successful exploitation yields either a denial-of-service condition on the host or, in the privilege-escalation case, elevated (root-level) access by manipulating entries in /etc/passwd. Any Red Hat system shipping the vulnerable libuser library is affected, with risk concentrated on multi-user servers where untrusted local accounts exist. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, indicating it is being exploited in the wild, and EPSS assigns it an 8.8% probability of exploitation within 30 days (95th percentile); ransomware use is unknown and no public proof-of-concept is cataloged.

Do: Update libuser to the fixed packages provided in Red Hat's security advisories across all RHEL/Fedora systems, prioritizing multi-user servers and any asset with untrusted local accounts, in line with CISA BOD 26-04 requirements (apply vendor mitigations or discontinue use of the product where mitigation is unavailable). Because exploitation requires local credentials, review which systems expose local login to non-administrators and check the integrity of /etc/passwd for signs of tampering. Confirm the patched library is active after update and monitor for further KEV-driven deadlines.

Red Hat JBoss Enterprise Application Platform's JMX-Console web application enforces its access-control checks only for the HTTP GET and POST methods, leaving requests sent with other HTTP verbs unauthenticated. A remote attacker can reach the console's GET handler by submitting the same request with a different method (e.g., HEAD), bypassing the configured authentication and access controls entirely. Once past the access control, the attacker can interact with the JMX console's management interfaces, a foothold that on many deployments can be escalated toward broader compromise of the JBoss server. Any organization running Red Hat JBoss (JBoss AS / JBoss EAP) where the JMX-Console is reachable, whether internally or exposed to the internet, is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-25) with known ransomware use, and EPSS assigns a 79.4% probability of exploitation within 30 days, so active exploitation should be assumed.

Do: Apply updates per Red Hat's vendor instructions, as required by CISA's KEV catalog. Until patched, restrict network access to the JMX-Console and block HTTP methods other than GET and POST (e.g., at a reverse proxy or in the application's security constraints) so the access-control check cannot be bypassed with verbs like HEAD, and review logs for requests to /jmx-console using unusual methods. Treat this flaw as actively exploited given its KEV listing with known ransomware use.

CVE-2015-5287 is a privilege escalation flaw in Red Hat's Automatic Bug Reporting Tool (ABRT) in which a local user with certain permissions can gain elevated privileges via a symlink attack against a file with a predictable name. Exploitation requires local access to an affected system; an attacker who triggers the flawed file-handling behavior can elevate their privileges on that machine. It affects deployments running ABRT, which ships by default with Red Hat Enterprise Linux and related distributions, including systems that may now be end-of-life or end-of-service. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-26, indicating exploitation has been observed in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS estimates a 5.0% probability of exploitation within 30 days (92nd percentile).

Do: Prioritize remediation per CISA BOD 26-04: inventory systems running ABRT (including EoL/EoS hosts), apply the updated abrt packages from Red Hat's security advisories, and migrate unsupported releases to a supported version. Where patching is not feasible, restrict local access to affected systems or disable/remove ABRT if it is not needed. Assess each asset's internet exposure and local user access, and triage per CISA's Forensics Triage Requirements.

JBoss Seam 2 (jboss-seam2), as used in Red Hat JBoss Enterprise Application Platform (EAP) 4.3.0 for Red Hat Linux, is vulnerable to remote code execution caused by an input validation flaw (CWE-20) in its processing of Expression Language (EL) expressions. A remote attacker triggers the flaw by sending crafted input containing EL expressions that the Seam framework evaluates without sufficient validation; exploitation succeeds only when the Java Security Manager is not properly configured, which is the typical default. Successful exploitation lets the attacker run arbitrary code with the privileges of the JBoss server process, providing a foothold on the host and access to any back-end systems the application server can reach. Organizations still running legacy Red Hat JBoss EAP 4.3.0 / Seam 2 deployments, particularly internet-facing ones, are in scope, and the flaw is in the CISA Known Exploited Vulnerabilities (KEV) catalog, obliging U.S. federal agencies to apply vendor updates. It was added to KEV on 2021-12-10, confirming in-the-wild exploitation (ransomware use unknown); it carries a very high EPSS of 83.4% (100th percentile) and no public proof-of-concept is known.

Do: Apply Red Hat's patched jboss-seam2 update for JBoss Enterprise Application Platform 4.3.0 per vendor instructions (RHSA-2010:0574); where immediate patching is not possible, properly configure the Java Security Manager for the JBoss JVM — the flaw is only exploitable when it is not properly configured — and restrict untrusted EL input and internet exposure of Seam-based applications. Inventory legacy JBoss EAP 4.x/Seam 2 hosts, prioritize internet-facing Linux servers given active Linux-targeting threats such as the SpeakUp backdoor, and check those hosts for signs of compromise. Remediation is required for U.S. federal agencies under CISA's KEV requirement (listed 2021-12-10).