Linux · Red Hat · Security advisory · September 23, 2026

RHSA-2026:70230: Security update for 41 packages

RHSA-2026:70230, released September 23, 2026, fixes 35 CVEs across 41 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
35
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0147
73rd percentile

Priority of the 35 CVEs

Patch now 0 Urgent 0 High 29 Routine 6

Fixed package versions

ProductReleaseFixed in
eap8-activemq-artemisRHEL 102.40.0-8.redhat_00024.1.el10eap
eap8-apache-cxfRHEL 104.1.7-1.SP1_redhat_00001.1.el10eap
eap8-artemis-wildfly-integrationRHEL 102.0.5-1.Final_redhat_00001.1.el10eap
eap8-bouncycastleRHEL 101.85.0-1.redhat_00001.1.el10eap
eap8-cryptacularRHEL 101.2.7-1.redhat_00002.1.el10eap
eap8-eap-product-conf-parentRHEL 10801.8.0-1.GA_redhat_00001.1.el10eap
eap8-hibernateRHEL 106.6.54-1.Final_redhat_00001.1.el10eap
eap8-httpcomponents-asyncclientRHEL 104.1.5-5.redhat_00008.1.el10eap
eap8-ironjacamarRHEL 103.0.22-1.Final_redhat_00001.1.el10eap
eap8-jackson-annotationsRHEL 102.18.9-1.redhat_00003.1.el10eap
eap8-jackson-coreRHEL 102.18.9-1.redhat_00003.1.el10eap
eap8-jackson-databindRHEL 102.18.9-1.redhat_00003.1.el10eap
eap8-jackson-dataformats-textRHEL 102.18.9-1.redhat_00003.1.el10eap
eap8-jackson-jaxrs-providersRHEL 102.18.9-1.redhat_00003.1.el10eap
eap8-jackson-modules-baseRHEL 102.18.9-1.redhat_00003.1.el10eap
eap8-jackson-modules-java8RHEL 102.18.9-1.redhat_00003.1.el10eap
eap8-jakarta-xml-bind-apiRHEL 104.0.5-1.redhat_00001.1.el10eap
eap8-jaxbRHEL 104.0.7-4.redhat_00001.1.el10eap
eap8-jaxbintrosRHEL 102.1.0-1.redhat_00001.1.el10eap
eap8-jboss-loggingRHEL 103.6.3-1.Final_redhat_00001.1.el10eap
eap8-jboss-remotingRHEL 105.0.31-1.SP2_redhat_00001.1.el10eap
eap8-jbossws-apiRHEL 103.1.0-1.Final_redhat_00001.1.el10eap
eap8-jbossws-common-toolsRHEL 102.2.0-1.Final_redhat_00001.1.el10eap
eap8-jbossws-cxfRHEL 107.4.0-1.Final_redhat_00001.1.el10eap
eap8-jbossws-jaxws-undertow-httpspiRHEL 103.0.1-1.Final_redhat_00001.1.el10eap
eap8-jbossws-spiRHEL 105.1.0-1.Final_redhat_00001.1.el10eap
eap8-jsf-implRHEL 104.0.11-2.SP1_redhat_00001.1.el10eap
eap8-log4jRHEL 102.25.4-1.redhat_00003.1.el10eap
eap8-neethiRHEL 103.2.2-1.redhat_00001.1.el10eap
eap8-nettyRHEL 104.1.136-1.Final_redhat_00001.1.el10eap
eap8-netty-transport-native-epollRHEL 104.1.136-1.Final_redhat_00001.1.el10eap
eap8-nimbus-jose-jwtRHEL 109.37.4-1.redhat_00001.1.el10eap
eap8-parssonRHEL 101.1.9-1.redhat_00001.1.el10eap
eap8-saaj-implRHEL 103.0.6-1.redhat_00001.1.el10eap
eap8-slf4jRHEL 102.0.18-1.redhat_00001.1.el10eap
eap8-undertowRHEL 102.3.26-2.SP3_redhat_00001.1.el10eap
eap8-wildflyRHEL 108.1.8-9.GA_redhat_00006.1.el10eap
eap8-wildfly-elytronRHEL 102.6.11-1.Final_redhat_00001.1.el10eap
eap8-wildfly-javadocsRHEL 108.1.1-12.GA_redhat_00048.1.el10eap
eap8-ws-commons-XmlSchemaRHEL 102.3.2-1.redhat_00001.1.el10eap
eap8-xml-securityRHEL 103.0.6-1.redhat_00001.1.el10eap

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-57967 eap8-activemq-artemis: An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and...7.4 0.0147 None reported
High CVE-2026-54513 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...8.1 0.0123 None reported
High CVE-2026-5680 eap8-activemq-artemis: A flaw was found in Undertow7.5 0.0110 None reported
High CVE-2026-54512 dogtag-pki: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor8.1 0.0107 None reported
High CVE-2026-15565 eap8-activemq-artemis: A flaw was found in Undertow7.5 0.0102 None reported
High CVE-2026-15562 eap8-activemq-artemis: A flaw was found in EAP's jboss-remoting7.5 0.0089 None reported
High CVE-2026-15567 eap8-activemq-artemis: A flaw was found in Wildfly7.5 0.0089 None reported
High CVE-2026-15555 eap8-activemq-artemis: A flaw was found in JBoss marshalling8.8 0.0084 None reported
High CVE-2026-49362 eap8-activemq-artemis: An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized...8.2 0.0082 None reported
High CVE-2026-3505 eap8-activemq-artemis: Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of th...7.5 0.0079 None reported
High CVE-2026-15560 eap8-activemq-artemis: when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unm...8.1 0.0075 None reported
High CVE-2026-15561 eap8-activemq-artemis: A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder7.5 0.0072 None reported
High CVE-2026-86404 eap8-activemq-artemis: EAP's Artemis deserialization configuration permits deserialization by default8.8 0.0070 None reported
High CVE-2026-50632 eap8-activemq-artemis: A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apa...8.8 0.0070 None reported
High CVE-2026-55831 eap8-activemq-artemis: Netty is a network application framework for development of protocol servers and clients7.5 0.0067 None reported
High CVE-2026-55833 eap8-activemq-artemis: Netty is a network application framework for development of protocol servers and clients7.5 0.0067 None reported
High CVE-2026-44417 eap8-activemq-artemis: The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that an...7.5 0.0066 None reported
High CVE-2026-15563 eap8-activemq-artemis: A flaw was found in EAP's IIOP7.4 0.0066 None reported
High CVE-2026-56745 eap8-activemq-artemis: Netty is a network application framework for development of protocol servers and clients7.5 0.0063 None reported
High CVE-2026-73508 eap8-activemq-artemis: Netty is an asynchronous, event-driven network application framework7.5 0.0063 None reported
High CVE-2026-59899 eap8-activemq-artemis: Netty is an asynchronous, event-driven network application framework7.5 0.0061 None reported
High CVE-2026-49364 eap8-activemq-artemis: An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials dur...8.0 0.0057 None reported
High CVE-2026-46581 eap8-activemq-artemis: In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/...8.1 0.0056 None reported
High CVE-2026-49875 eap8-activemq-artemis: Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necess...7.5 0.0053 None reported
High CVE-2026-59649 eap8-activemq-artemis: In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory7.5 0.0049 None reported
Showing 1 to 25 of 35 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.