Loading story…
Red Hat released important asynchronous security updates for Red Hat Satellite 6.16 and 6.17, shipping Satellite 6.16.8 for RHEL 8 and 9 and Satellite 6.17.8 for RHEL 9. The advisories remediate five vulnerabilities in bundled components: CVE-2026-25990 in Pillow, CVE-2026-27727 in mchange-commons-java used by candlepin, CVE-2025-69534 in python-markdown, CVE-2026-27459 in pyOpenSSL, and CVE-2026-33176 in Ruby Active Support. Affected products include Satellite, Satellite Capsule, and Extended Update Support variants for the supported RHEL releases.
Red Hat also fixed several Satellite-specific security issues, including cleartext proxy password exposure in Virt-who Configuration, certificate and key artifacts left in the rhsm cache, and enforcement of HTTPS-only global registration. The Active Support flaw, CVE-2026-33176, could trigger denial of service because large scientific-notation strings such as 1e10000 cause BigDecimal to expand them into massive decimal values, consuming excessive memory and CPU; Red Hat said the issue was addressed in Satellite 6.16 and 6.17 through advisories RHSA-2026:14874 and RHSA-2026:14873.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-07, Red Hat published RHSA-2026:14874, an Important security advisory for Red Hat Satellite 6.16 on RHEL 8 and RHEL 9. The async update released Satellite 6.16.8 and fixed five vulnerabilities, including CVE-2026-33176 in Active Support, plus several Satellite-specific issues such as cleartext proxy password exposure, rhsm cache certificate/key artifacts, and enforcing HTTPS during global registration.
On 2026-05-07, Red Hat published RHSA-2026:14873, an Important security advisory for Red Hat Satellite 6.17 on RHEL 9. The async update released Satellite 6.17.8 and fixed five vulnerabilities, including CVE-2026-33176 in Active Support, along with multiple Satellite-specific bugs such as HTTPS-only global registration, rhsm cache certificate/key exposure, and cleartext proxy password display.
A denial-of-service vulnerability in Active Support affecting versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1 was patched in those upstream versions. The issue stemmed from scientific-notation strings such as `1e10000` being expanded into extremely large decimal values, causing excessive memory and CPU consumption during formatting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for **Red Hat Satellite** that address six vulnerabilities in Satellite 6.17 and 6.18 deployments on RHEL 9. The advisories cover **Red Hat Satellite 6.17.9.1** and **Red Hat Satellite 6.18.7.1**, along with affected **Satellite Capsule** packages, and remediate flaws in `pulpcore` and `yggdrasil-worker-forwarder` components used by the platform. The fixed issues include an authorization bypass in **gRPC-Go**, multiple **Go**-related denial-of-service vulnerabilities, an **IDNA/Punycode** privilege-escalation issue, and a `pulpcore` directory traversal validator bypass. Red Hat said the updates affect Satellite 6.17 and 6.18 environments for `x86_64` on RHEL 9, and one advisory also resolves an upgrade bug that could cause failures during migration from Satellite 6.16 to 6.17 with a `pulpcore-manager rpm-datarepair` `CommandError`.
Aug 20, 2026
Red Hat released security updates for Satellite and Capsule deployments addressing vulnerabilities that could expose provisioning secrets or enable code execution across managed infrastructure. Advisories **RHSA-2026:74504, RHSA-2026:74505, and RHSA-2026:74506** deliver Satellite **6.18.10, 6.17.12, and 6.16.14**, respectively, fixing 23–24 CVEs per release. Key flaws include **CVE-2026-12423**, which lets unauthenticated attackers retrieve provisioning templates containing root password hashes, internal network details, and build tokens while hosts are being provisioned; **CVE-2026-12405**, which permits command injection by users with job-template execution permissions when the effective-user parameter is overridable; and **CVE-2026-12540**, which enables command injection through a log-fetch task available to users with specific sudo permissions. Separately, **CVE-2026-96659**, rated CVSS 9.1, allows low-privileged authenticated users to access sensitive host information through Foreman template previews, with potential code execution when Safemode protections are disabled or bypassed. Fixes for that flaw are available for Satellite 6.16, 6.18, and 6.19. The updates also address a Foreman Safemode bypass, Dynaconf server-side template injection, and vulnerabilities across Katello, GitPython, Go components, and other dependencies. The three release advisories carry Critical headers, although their descriptive text rates the security impact Important; none reports active exploitation. Administrators should apply prerequisite errata and the appropriate security updates to affected Satellite Server and Capsule Server installations, review Viewer-role and job-execution permissions, keep Safemode enabled, and investigate suspicious template-preview activity. **Satellite 6.16.14 introduces an operational change:** unattended template downloads for Red Hat-family operating systems require valid provisioning tokens, disrupting Generic and Subnet Bootdisk workflows. Full Host Bootdisks support the tokens; disabling enforcement restores the alternative workflows but reopens unauthenticated access to potentially sensitive provisioning data.
Oct 3, 2026
Red Hat released **Important** security updates for OpenSSL across multiple **RHEL 9** and **RHEL 10** channels to address two high-impact vulnerabilities, **`CVE-2025-15467`** and **`CVE-2025-69419`**. The first flaw affects parsing of CMS `AuthEnvelopedData` with AEAD ciphers, where an oversized initialization vector can overflow a fixed-size stack buffer before authentication or tag verification, creating a path to denial of service and possible remote code execution. The second flaw is a memory corruption bug in PKCS#12 processing, where `BMPString` to UTF-8 conversion can trigger an out-of-bounds heap write when an application parses an attacker-controlled PKCS#12 file, potentially causing a crash or arbitrary code execution. Upstream fixes were issued in OpenSSL **3.0.19**, **3.3.6**, **3.4.4**, **3.5.5**, **3.6.1**, and **1.1.1ze** for the affected branches, while OpenSSL **1.0.2** is not affected and the OpenSSL FIPS modules are outside the vulnerable code paths. Red Hat advisories including **RHSA-2026:1496**, **RHSA-2026:1503**, **RHSA-2026:1519**, **RHSA-2026:1594**, and **RHSA-2026:1733** cover impacted products such as RHEL 9.0, 9.2, 9.4, 9.6, and 10.0 variants, along with related SAP, AUS, EUS, OpenShift, and JBoss Core Services offerings, with updated package builds released for major architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x`.
Aug 20, 2026