Linux · Security advisory · November 7, 2026

ELSA-2026-94500: Security update for 55 packages

ELSA-2026-94500, released November 7, 2026, fixes 5 CVEs across 55 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
5
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0024
14th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 1 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
fence-agents-aliyunol 90:4.10.0-110.el9_8.8
fence-agents-allol 90:4.10.0-110.el9_8.8
fence-agents-amt-wsol 90:4.10.0-110.el9_8.8
fence-agents-apcol 90:4.10.0-110.el9_8.8
fence-agents-apc-snmpol 90:4.10.0-110.el9_8.8
fence-agents-awsol 90:4.10.0-110.el9_8.8
fence-agents-azure-armol 90:4.10.0-110.el9_8.8
fence-agents-bladecenterol 90:4.10.0-110.el9_8.8
fence-agents-brocadeol 90:4.10.0-110.el9_8.8
fence-agents-cisco-mdsol 90:4.10.0-110.el9_8.8
fence-agents-cisco-ucsol 90:4.10.0-110.el9_8.8
fence-agents-commonol 90:4.10.0-110.el9_8.8
fence-agents-computeol 90:4.10.0-110.el9_8.8
fence-agents-drac5ol 90:4.10.0-110.el9_8.8
fence-agents-eaton-snmpol 90:4.10.0-110.el9_8.8
fence-agents-emersonol 90:4.10.0-110.el9_8.8
fence-agents-epsol 90:4.10.0-110.el9_8.8
fence-agents-gceol 90:4.10.0-110.el9_8.8
fence-agents-heuristics-pingol 90:4.10.0-110.el9_8.8
fence-agents-hpbladeol 90:4.10.0-110.el9_8.8
fence-agents-ibm-powervsol 90:4.10.0-110.el9_8.8
fence-agents-ibm-vpcol 90:4.10.0-110.el9_8.8
fence-agents-ibmbladeol 90:4.10.0-110.el9_8.8
fence-agents-ifmibol 90:4.10.0-110.el9_8.8
fence-agents-ilo-moonshotol 90:4.10.0-110.el9_8.8
fence-agents-ilo-mpol 90:4.10.0-110.el9_8.8
fence-agents-ilo-sshol 90:4.10.0-110.el9_8.8
fence-agents-ilo2ol 90:4.10.0-110.el9_8.8
fence-agents-intelmodularol 90:4.10.0-110.el9_8.8
fence-agents-ipduol 90:4.10.0-110.el9_8.8
fence-agents-ipmilanol 90:4.10.0-110.el9_8.8
fence-agents-kdumpol 90:4.10.0-110.el9_8.8
fence-agents-kubevirtol 90:4.10.0-110.el9_8.8
fence-agents-lparol 90:4.10.0-110.el9_8.8
fence-agents-mpathol 90:4.10.0-110.el9_8.8
fence-agents-nutanix-ahvol 90:4.10.0-110.el9_8.8
fence-agents-openstackol 90:4.10.0-110.el9_8.8
fence-agents-redfishol 90:4.10.0-110.el9_8.8
fence-agents-rhevmol 90:4.10.0-110.el9_8.8
fence-agents-rsaol 90:4.10.0-110.el9_8.8
fence-agents-rsbol 90:4.10.0-110.el9_8.8
fence-agents-sbdol 90:4.10.0-110.el9_8.8
fence-agents-scsiol 90:4.10.0-110.el9_8.8
fence-agents-virshol 90:4.10.0-110.el9_8.8
fence-agents-vmware-restol 90:4.10.0-110.el9_8.8
fence-agents-vmware-soapol 90:4.10.0-110.el9_8.8
fence-agents-wtiol 90:4.10.0-110.el9_8.8
fence-virtol 90:4.10.0-110.el9_8.8
fence-virtdol 90:4.10.0-110.el9_8.8
fence-virtd-cpgol 90:4.10.0-110.el9_8.8
fence-virtd-libvirtol 90:4.10.0-110.el9_8.8
fence-virtd-multicastol 90:4.10.0-110.el9_8.8
fence-virtd-serialol 90:4.10.0-110.el9_8.8
fence-virtd-tcpol 90:4.10.0-110.el9_8.8
ha-cloud-supportol 90:4.10.0-110.el9_8.8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-102268 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard 9.1 0.0024 None reported
High CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation 9.1 0.0023 None reported
High CVE-2026-102272 PyJWT BOM Bypass 9.1 0.0022 None reported
High CVE-2026-102271 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard 9.1 0.0022 None reported
High CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS 9.1 0.0016 None reported
Showing 1 to 5 of 5 1