Red Hat vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 36 Red Hat CVEs published between 2014-09-15 and 2026-10-15. The busiest month was 2026-09 (10 new CVEs). 8 of them (22%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 36 of 36 tracked Red Hat CVEs.

• CVE-2014-6271critical 9.8KEVEPSS 100%2014-09-24
• CVE-2017-8291high 7.8KEVEPSS 97%2017-04-27
• CVE-2016-5195high 7KEVRansomwareEPSS 93.9%2016-11-10
• CVE-2016-4437critical 9.8KEVEPSS 93.1%2016-06-07
• CVE-2022-0847high 7.8KEVEPSS 92.8%2022-03-07
• CVE-2021-4034high 7.8KEVEPSS 87.8%2022-01-28
• CVE-2023-4911high 7.8KEVEPSS 81.4%2023-10-03
• CVE-2023-32373high 8.8KEVEPSS 0%2023-06-23
• CVE-2024-6387high 8.1EPSS 99.5%2024-07-01
• CVE-2026-75887high 7.5EPSS 0.4%2026-09-23
• CVE-2026-86344high 7.5EPSS 0.3%2026-10-01
• CVE-2026-71473high 8.5EPSS 0.3%2026-08-12
• CVE-2026-17059medium 6.5EPSS 0.2%2026-07-24
• CVE-2026-12515medium 4.3EPSS 0.2%2026-06-17
• CVE-2025-11395medium 5.5EPSS 0.2%2026-09-15
• CVE-2026-92248high 7.8EPSS 0.2%2026-09-15
• CVE-2026-7867high 7.8EPSS 0.2%2026-08-06
• CVE-2026-18090medium 6.1EPSS 0.2%2026-09-08
• CVE-2026-71846medium 6.5EPSS 0.1%2026-08-12
• CVE-2026-81893medium 4.7EPSS 0.1%2026-08-27
• CVE-2026-86564low 3.3EPSS 0.1%2026-09-08
• CVE-2026-80158medium 5.5EPSS 0.1%2026-08-26
• CVE-2026-16517low 2.9EPSS 0.1%2026-07-21
• CVE-2026-4480high 8.5EPSS 0.1%2026-05-26
• CVE-2026-56208high 7.62026-06-19
• CVE-2026-96280high 7.52026-09-27
• CVE-2026-3195high 7.42026-06-19
• CVE-2026-56209high 7.12026-06-19
• CVE-2026-56210high 7.12026-06-19
• CVE-2026-56211high 7.12026-06-19
• CVE-2026-96281medium 6.22026-09-27
• CVE-2026-3196medium 5.52026-06-19
• CVE-2026-6426medium 4.42026-08-10
• CVE-2026-96283low 3.32026-09-27
• CVE-2026-96282low 3.12026-09-27
• CVE-2026-96284low 2.52026-09-27

Products affected

Threadlinqs normalises CPE and CNA product records across all 36 CVEs; 66 distinct Red Hat products are affected. The most frequently affected (top 20):

• Enterprise Linux 9 23 CVEs
• Enterprise Linux 10 22 CVEs
• Enterprise Linux 8 18 CVEs
• Enterprise Linux 7 16 CVEs
• Enterprise Linux 6 11 CVEs
• OpenShift Container Platform 4 8 CVEs
• Hardened Images 7 CVEs
• Enterprise Linux 5 CVEs
• Enterprise Linux Eus 5 CVEs
• Enterprise Linux AI (RHEL AI) 3 4 CVEs
• Enterprise Linux Desktop 3 CVEs
• Enterprise Linux For Ibm Z Systems 3 CVEs
• Enterprise Linux Server Aus 3 CVEs
• Enterprise Linux Server Tus 3 CVEs
• Advanced Cluster Management for Kubernetes 2 2 CVEs
• Ceph Storage 5 2 CVEs
• Enterprise Linux For Ibm Z Systems Eus 2 CVEs
• Enterprise Linux For Power Little Endian 2 CVEs
• Enterprise Linux For Power Little Endian Eus 2 CVEs
• Enterprise Linux Server 2 CVEs

Threat activity

51 tracked threat campaigns reference Red Hat products or exploit Red Hat CVEs; the 25 most recent are listed.

• Red Hat Satellite Foreman template preview authorization flaw (CVE-2026-96659) enables root password theft and code executionCRITICAL2026-10-03
• Autonomous AI Agent Operation (Strix, Cairn, Hermes) Steals 600K+ Payment Cards and Injects Skimmers into 100+ E-Commerce SitesCRITICAL2026-09-23
• Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti UniFi OS Flaws to Steal Government DataCRITICAL2026-09-22
• CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables SNAT Privilege Escalation, and AF_ALG Race Condition (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)CRITICAL2026-09-19
• CVE-2025-39682 — Linux Kernel net/tls rx_list Zero-Length Record Use-After-Free Added to CISA KEV CatalogCRITICAL2026-09-18
• Attacker Maintains Root-Level MeshCentral Backdoor Inside Thai ISP 3BB, Targets RADIUS Subscriber-Credential Databases (CVE-2024-21762 Toolkit Staged)HIGH2026-09-15
• Chinese-Speaking Operator "Nie" Uses SecFlow AI Orchestration Framework (Claude, Qwen, DeepSeek) and GLUTTON Steganographic Webshell in Multi-Country Espionage CampaignHIGH2026-09-04
• BREEZE COMET (ex-UNC5669) Targets Brazilian Financial Infrastructure with AI-Assisted Custom Malware SuiteCRITICAL2026-09-01
• EtherHiding: Blockchain-Based C2 on Polygon Fuels ClickFix Backdoor + Banking-Trojan Extension Campaign Adopted by Criminal, North Korean, and Iran-Linked ActorsHIGH2026-09-01
• CVE-2026-53362 ("ipv6_frag_escape"): Linux Kernel IPv6 Fragmentation Flaw Enables Container-to-Host Privilege Escalation, Actively Exploited — Added to CISA KEVHIGH2026-08-29
• Chinese-speaking threat group UAT-10147 uses agentic AI to automate exploitation of internet-facing web serversHIGH2026-08-21
• PATCHCORD, SHEETCORD & HACKERAI C2 Agent: New Malware Cluster Targets Afghan Telecom and South Asian Critical Infrastructure (APT36-linked)HIGH2026-08-13
• Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)CRITICAL2026-08-06
• CVE-2026-64561 — Zapscape: KVM/x86 Shadow MMU Use-After-Free Allows L1 Guest Escape to Linux HostHIGH2026-08-06
• CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass Actively Exploited in SnowLight and AI-Assisted CampaignsHIGH2026-08-05
• OVSWrap (CVE-2026-64531): Linux kernel Open vSwitch datapath 16-bit nla_len wraparound local privilege escalation with public PoC targeting ~800 x86-64 kernel buildsHIGH2026-08-05
• CVE-2026-31431: Linux Local Privilege Escalation Actively Exploited by UMBRAL BISON Within 24 Hours of DisclosureHIGH2026-08-03
• CVE-2026-17059: Keycloak Admin REST API Broken Object-Level Authorization Exposes User PIIMEDIUM2026-07-31
• CVE-2026-53264: AI-Assisted Discovery of Linux Kernel net/sched Use-After-Free Enabling Local Root Privilege EscalationHIGH2026-07-28
• RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)HIGH2026-07-22
• Pwn2Own Berlin 2026 Day Three: Zero-Days Demonstrated in VMware ESXi, Microsoft SharePoint, Windows 11, Red Hat Linux, and Anthropic Claude CodeHIGH2026-07-19
• F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) — Linux Kernel ptrace/pidfd_getfd Race Condition, Public PoC (CHARON)HIGH2026-07-18
• CVE-2026-46215: Linux Kernel DRM GEM_CHANGE_HANDLE Use-After-Free Local Root Privilege EscalationHIGH2026-07-18
• Forgotten UEFI Shims Undermine Secure Boot (CVE-2026-8863, CVE-2026-10797)HIGH2026-07-14
• 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure Boot Bypass (CVE-2026-8863, CVE-2026-10797)HIGH2026-07-14

Threat actors targeting Red Hat

Named threat actors attributed to campaigns that involve Red Hat products or CVEs, with the number of linked campaigns:

• TeamPCP 3
• Andariel 2
• StrikeShark 2
• APT36 1
• APT38 1
• Kapibala 1
• Lazarus Group 1
• Miasma operator 1
• Mini Shai-Hulud 1
• PCPJack 1
• Sapphire Sleet 1
• Shai-Hulud 1

How to prioritise Red Hat patching

This order follows the data Threadlinqs holds for Red Hat, not a generic severity checklist:

• 8 of 36 Red Hat CVEs (22%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2014-6271, CVE-2017-8291, CVE-2016-5195.
• 1 CVE is known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
• Outside KEV, the highest EPSS scores are CVE-2024-6387 (99.5%), CVE-2026-75887 (0.4%), CVE-2026-86344 (0.3%).
• 2 CVEs score Critical and 19 High on CVSS v3 (maximum 9.8, average 6.6); sequence these after KEV and high-EPSS items.
• 8 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily.