# RHSA-2026:70230: Security update for 41 packages

RHSA-2026:70230, released September 23, 2026, fixes 35 CVEs across 41 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/rhsa-2026-70230
- Platform: Linux
- Released: Sep 23, 2026
- Priority: High (Closes CVE-2026-57967, high severity)
- CVEs: 35, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://access.redhat.com/errata/RHSA-2026:70230

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [eap8-activemq-artemis](https://patchblox.com/security/data/product/linux/eap8-activemq-artemis.md) | RHEL 10 | 2.40.0-8.redhat_00024.1.el10eap |
| [eap8-apache-cxf](https://patchblox.com/security/data/product/linux/eap8-apache-cxf.md) | RHEL 10 | 4.1.7-1.SP1_redhat_00001.1.el10eap |
| [eap8-artemis-wildfly-integration](https://patchblox.com/security/data/product/linux/eap8-artemis-wildfly-integration.md) | RHEL 10 | 2.0.5-1.Final_redhat_00001.1.el10eap |
| [eap8-bouncycastle](https://patchblox.com/security/data/product/linux/eap8-bouncycastle.md) | RHEL 10 | 1.85.0-1.redhat_00001.1.el10eap |
| [eap8-cryptacular](https://patchblox.com/security/data/product/linux/eap8-cryptacular.md) | RHEL 10 | 1.2.7-1.redhat_00002.1.el10eap |
| [eap8-eap-product-conf-parent](https://patchblox.com/security/data/product/linux/eap8-eap-product-conf-parent.md) | RHEL 10 | 801.8.0-1.GA_redhat_00001.1.el10eap |
| [eap8-hibernate](https://patchblox.com/security/data/product/linux/eap8-hibernate.md) | RHEL 10 | 6.6.54-1.Final_redhat_00001.1.el10eap |
| [eap8-httpcomponents-asyncclient](https://patchblox.com/security/data/product/linux/eap8-httpcomponents-asyncclient.md) | RHEL 10 | 4.1.5-5.redhat_00008.1.el10eap |
| [eap8-ironjacamar](https://patchblox.com/security/data/product/linux/eap8-ironjacamar.md) | RHEL 10 | 3.0.22-1.Final_redhat_00001.1.el10eap |
| [eap8-jackson-annotations](https://patchblox.com/security/data/product/linux/eap8-jackson-annotations.md) | RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap |
| [eap8-jackson-core](https://patchblox.com/security/data/product/linux/eap8-jackson-core.md) | RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap |
| [eap8-jackson-databind](https://patchblox.com/security/data/product/linux/eap8-jackson-databind.md) | RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap |
| [eap8-jackson-dataformats-text](https://patchblox.com/security/data/product/linux/eap8-jackson-dataformats-text.md) | RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap |
| [eap8-jackson-jaxrs-providers](https://patchblox.com/security/data/product/linux/eap8-jackson-jaxrs-providers.md) | RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap |
| [eap8-jackson-modules-base](https://patchblox.com/security/data/product/linux/eap8-jackson-modules-base.md) | RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap |
| [eap8-jackson-modules-java8](https://patchblox.com/security/data/product/linux/eap8-jackson-modules-java8.md) | RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap |
| [eap8-jakarta-xml-bind-api](https://patchblox.com/security/data/product/linux/eap8-jakarta-xml-bind-api.md) | RHEL 10 | 4.0.5-1.redhat_00001.1.el10eap |
| [eap8-jaxb](https://patchblox.com/security/data/product/linux/eap8-jaxb.md) | RHEL 10 | 4.0.7-4.redhat_00001.1.el10eap |
| [eap8-jaxbintros](https://patchblox.com/security/data/product/linux/eap8-jaxbintros.md) | RHEL 10 | 2.1.0-1.redhat_00001.1.el10eap |
| [eap8-jboss-logging](https://patchblox.com/security/data/product/linux/eap8-jboss-logging.md) | RHEL 10 | 3.6.3-1.Final_redhat_00001.1.el10eap |
| [eap8-jboss-remoting](https://patchblox.com/security/data/product/linux/eap8-jboss-remoting.md) | RHEL 10 | 5.0.31-1.SP2_redhat_00001.1.el10eap |
| [eap8-jbossws-api](https://patchblox.com/security/data/product/linux/eap8-jbossws-api.md) | RHEL 10 | 3.1.0-1.Final_redhat_00001.1.el10eap |
| [eap8-jbossws-common-tools](https://patchblox.com/security/data/product/linux/eap8-jbossws-common-tools.md) | RHEL 10 | 2.2.0-1.Final_redhat_00001.1.el10eap |
| [eap8-jbossws-cxf](https://patchblox.com/security/data/product/linux/eap8-jbossws-cxf.md) | RHEL 10 | 7.4.0-1.Final_redhat_00001.1.el10eap |
| [eap8-jbossws-jaxws-undertow-httpspi](https://patchblox.com/security/data/product/linux/eap8-jbossws-jaxws-undertow-httpspi.md) | RHEL 10 | 3.0.1-1.Final_redhat_00001.1.el10eap |
| [eap8-jbossws-spi](https://patchblox.com/security/data/product/linux/eap8-jbossws-spi.md) | RHEL 10 | 5.1.0-1.Final_redhat_00001.1.el10eap |
| [eap8-jsf-impl](https://patchblox.com/security/data/product/linux/eap8-jsf-impl.md) | RHEL 10 | 4.0.11-2.SP1_redhat_00001.1.el10eap |
| [eap8-log4j](https://patchblox.com/security/data/product/linux/eap8-log4j.md) | RHEL 10 | 2.25.4-1.redhat_00003.1.el10eap |
| [eap8-neethi](https://patchblox.com/security/data/product/linux/eap8-neethi.md) | RHEL 10 | 3.2.2-1.redhat_00001.1.el10eap |
| [eap8-netty](https://patchblox.com/security/data/product/linux/eap8-netty.md) | RHEL 10 | 4.1.136-1.Final_redhat_00001.1.el10eap |
| [eap8-netty-transport-native-epoll](https://patchblox.com/security/data/product/linux/eap8-netty-transport-native-epoll.md) | RHEL 10 | 4.1.136-1.Final_redhat_00001.1.el10eap |
| [eap8-nimbus-jose-jwt](https://patchblox.com/security/data/product/linux/eap8-nimbus-jose-jwt.md) | RHEL 10 | 9.37.4-1.redhat_00001.1.el10eap |
| [eap8-parsson](https://patchblox.com/security/data/product/linux/eap8-parsson.md) | RHEL 10 | 1.1.9-1.redhat_00001.1.el10eap |
| [eap8-saaj-impl](https://patchblox.com/security/data/product/linux/eap8-saaj-impl.md) | RHEL 10 | 3.0.6-1.redhat_00001.1.el10eap |
| [eap8-slf4j](https://patchblox.com/security/data/product/linux/eap8-slf4j.md) | RHEL 10 | 2.0.18-1.redhat_00001.1.el10eap |
| [eap8-undertow](https://patchblox.com/security/data/product/linux/eap8-undertow.md) | RHEL 10 | 2.3.26-2.SP3_redhat_00001.1.el10eap |
| [eap8-wildfly](https://patchblox.com/security/data/product/linux/eap8-wildfly.md) | RHEL 10 | 8.1.8-9.GA_redhat_00006.1.el10eap |
| [eap8-wildfly-elytron](https://patchblox.com/security/data/product/linux/eap8-wildfly-elytron.md) | RHEL 10 | 2.6.11-1.Final_redhat_00001.1.el10eap |
| [eap8-wildfly-javadocs](https://patchblox.com/security/data/product/linux/eap8-wildfly-javadocs.md) | RHEL 10 | 8.1.1-12.GA_redhat_00048.1.el10eap |
| [eap8-ws-commons-XmlSchema](https://patchblox.com/security/data/product/linux/eap8-ws-commons-xmlschema.md) | RHEL 10 | 2.3.2-1.redhat_00001.1.el10eap |
| [eap8-xml-security](https://patchblox.com/security/data/product/linux/eap8-xml-security.md) | RHEL 10 | 3.0.6-1.redhat_00001.1.el10eap |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-57967](https://patchblox.com/security/data/cve/CVE-2026-57967.md) | High | eap8-activemq-artemis: An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and... | 7.4 | 0.0147 |  |
| [CVE-2026-54513](https://patchblox.com/security/data/cve/CVE-2026-54513.md) | High | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.  Secur... | 8.1 | 0.0123 |  |
| [CVE-2026-5680](https://patchblox.com/security/data/cve/CVE-2026-5680.md) | High | eap8-activemq-artemis: A flaw was found in Undertow | 7.5 | 0.0110 |  |
| [CVE-2026-54512](https://patchblox.com/security/data/cve/CVE-2026-54512.md) | High | dogtag-pki: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor | 8.1 | 0.0107 |  |
| [CVE-2026-15565](https://patchblox.com/security/data/cve/CVE-2026-15565.md) | High | eap8-activemq-artemis: A flaw was found in Undertow | 7.5 | 0.0102 |  |
| [CVE-2026-15562](https://patchblox.com/security/data/cve/CVE-2026-15562.md) | High | eap8-activemq-artemis: A flaw was found in EAP's jboss-remoting | 7.5 | 0.0089 |  |
| [CVE-2026-15567](https://patchblox.com/security/data/cve/CVE-2026-15567.md) | High | eap8-activemq-artemis: A flaw was found in Wildfly | 7.5 | 0.0089 |  |
| [CVE-2026-15555](https://patchblox.com/security/data/cve/CVE-2026-15555.md) | High | eap8-activemq-artemis: A flaw was found in JBoss marshalling | 8.8 | 0.0084 |  |
| [CVE-2026-49362](https://patchblox.com/security/data/cve/CVE-2026-49362.md) | High | eap8-activemq-artemis: An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized... | 8.2 | 0.0082 |  |
| [CVE-2026-3505](https://patchblox.com/security/data/cve/CVE-2026-3505.md) | High | eap8-activemq-artemis: Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of th... | 7.5 | 0.0079 |  |
| [CVE-2026-15560](https://patchblox.com/security/data/cve/CVE-2026-15560.md) | High | eap8-activemq-artemis: when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unm... | 8.1 | 0.0075 |  |
| [CVE-2026-15561](https://patchblox.com/security/data/cve/CVE-2026-15561.md) | High | eap8-activemq-artemis: A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder | 7.5 | 0.0072 |  |
| [CVE-2026-86404](https://patchblox.com/security/data/cve/CVE-2026-86404.md) | High | eap8-activemq-artemis: EAP's Artemis deserialization configuration permits deserialization by default | 8.8 | 0.0070 |  |
| [CVE-2026-50632](https://patchblox.com/security/data/cve/CVE-2026-50632.md) | High | eap8-activemq-artemis: A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apa... | 8.8 | 0.0070 |  |
| [CVE-2026-55831](https://patchblox.com/security/data/cve/CVE-2026-55831.md) | High | eap8-activemq-artemis: Netty is a network application framework for development of protocol servers and clients | 7.5 | 0.0067 |  |
| [CVE-2026-55833](https://patchblox.com/security/data/cve/CVE-2026-55833.md) | High | eap8-activemq-artemis: Netty is a network application framework for development of protocol servers and clients | 7.5 | 0.0067 |  |
| [CVE-2026-44417](https://patchblox.com/security/data/cve/CVE-2026-44417.md) | High | eap8-activemq-artemis: The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that an... | 7.5 | 0.0066 |  |
| [CVE-2026-15563](https://patchblox.com/security/data/cve/CVE-2026-15563.md) | High | eap8-activemq-artemis: A flaw was found in EAP's IIOP | 7.4 | 0.0066 |  |
| [CVE-2026-56745](https://patchblox.com/security/data/cve/CVE-2026-56745.md) | High | eap8-activemq-artemis: Netty is a network application framework for development of protocol servers and clients | 7.5 | 0.0063 |  |
| [CVE-2026-73508](https://patchblox.com/security/data/cve/CVE-2026-73508.md) | High | eap8-activemq-artemis: Netty is an asynchronous, event-driven network application framework | 7.5 | 0.0063 |  |
| [CVE-2026-59899](https://patchblox.com/security/data/cve/CVE-2026-59899.md) | High | eap8-activemq-artemis: Netty is an asynchronous, event-driven network application framework | 7.5 | 0.0061 |  |
| [CVE-2026-49364](https://patchblox.com/security/data/cve/CVE-2026-49364.md) | High | eap8-activemq-artemis: An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials dur... | 8.0 | 0.0057 |  |
| [CVE-2026-46581](https://patchblox.com/security/data/cve/CVE-2026-46581.md) | High | eap8-activemq-artemis: In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/... | 8.1 | 0.0056 |  |
| [CVE-2026-49875](https://patchblox.com/security/data/cve/CVE-2026-49875.md) | High | eap8-activemq-artemis: Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necess... | 7.5 | 0.0053 |  |
| [CVE-2026-59649](https://patchblox.com/security/data/cve/CVE-2026-59649.md) | High | eap8-activemq-artemis: In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory | 7.5 | 0.0049 |  |
| [CVE-2026-15554](https://patchblox.com/security/data/cve/CVE-2026-15554.md) | High | eap8-activemq-artemis: the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authe... | 7.4 | 0.0048 |  |
| [CVE-2026-68494](https://patchblox.com/security/data/cve/CVE-2026-68494.md) | High | eap8-activemq-artemis: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint... | 7.5 | 0.0046 |  |
| [CVE-2026-56746](https://patchblox.com/security/data/cve/CVE-2026-56746.md) | High | eap8-activemq-artemis: Netty is a network application framework for development of protocol servers and clients | 7.5 | 0.0041 |  |
| [CVE-2026-62243](https://patchblox.com/security/data/cve/CVE-2026-62243.md) | High | eap8-activemq-artemis: Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disa... | 7.5 | 0.0016 |  |
| [CVE-2026-14180](https://patchblox.com/security/data/cve/CVE-2026-14180.md) | Routine | eap8-activemq-artemis: A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to... | 5.3 | 0.0103 |  |
| [CVE-2026-49363](https://patchblox.com/security/data/cve/CVE-2026-49363.md) | Routine | eap8-activemq-artemis: An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a S... | 5.3 | 0.0080 |  |
| [CVE-2026-10832](https://patchblox.com/security/data/cve/CVE-2026-10832.md) | Routine | eap8-activemq-artemis: A flaw was found in the DERDecoder class within wildfly-elytron-asn1 | 5.9 | 0.0072 |  |
| [CVE-2026-54515](https://patchblox.com/security/data/cve/CVE-2026-54515.md) | Routine | eap8-activemq-artemis: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor | 5.3 | 0.0044 |  |
| [CVE-2026-59889](https://patchblox.com/security/data/cve/CVE-2026-59889.md) | Routine | eap8-activemq-artemis: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor | 6.5 | 0.0035 |  |
| [CVE-2026-85511](https://patchblox.com/security/data/cve/CVE-2026-85511.md) | Routine | eap8-activemq-artemis: A flaw was found in EAP's Elytron | 4.2 | 0.0028 |  |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.