Red Hat vendor intelligence

Red Hat Known Exploited Vulnerabilities

Track evidence-backed exploitation affecting Red Hat products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.

Browse Red Hat KEVs Full KEV feed

Total KEVs: 7; Known exploited vulnerabilities affecting Red Hat products
In CISA KEV: 5; Records also listed in the official catalog
Beyond CISA KEV: 2; Additional exploited CVEs absent from CISA KEV
Sensor Observed: 0; Red Hat KEVs with sensor-observed exploitation activity

The catalog gap matters for Red Hat exposure

Two of the seven exploited Red Hat CVEs tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss 29% of this vendor portfolio.

71%
Covered by CISA: 29%
Beyond CISA: 5
Product families

Attested Red Hat CVEs

Search the exploited-vulnerability portfolio, then narrow it to official CISA coverage or the additional records KEV Intelligence tracks beyond the catalog.

How exploitation is verified

CVE / description	Product	Confidence	CISA KEV	Added
CVE-2026-4631 Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection	Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8	High	Beyond CISA	08 Jul 2026
CVE-2010-1871 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss...	JBoss Enterprise Application Platform	Confirmed	In CISA	10 Dec 2021
CVE-2017-12149 In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the...	jbossas	Confirmed	In CISA	10 Dec 2021
CVE-2010-0738 The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3...	JBoss Enterprise Application Platform	Confirmed	In CISA	25 May 2022
CVE-2010-1428 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and...	JBoss Enterprise Application Platform	Confirmed	In CISA	25 May 2022
CVE-2023-4911 Glibc: buffer overflow in ld.so leading to privilege escalation	, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7	Confirmed	In CISA	21 Nov 2023
CVE-2020-10770 A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter...	Keycloak	High	Beyond CISA	15 Dec 2020

Showing 7 of 7 Red Hat known exploited vulnerabilities.

Recurring weakness patterns

Exposed dangerous method or function, heap-based buffer overflow, and deserialization account for four mapped occurrences across this Red Hat KEV portfolio.

Browse all KEVs →

CWE-749

Exposed Dangerous Method or Function

CWE-122

Heap-based Buffer Overflow

CWE-502

Deserialization of Untrusted Data

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CWE-918

Server-Side Request Forgery (SSRF)

Early warning alerts

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.