Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Security vendor · Software supply chain security · in CISA KEV

Red Hat in the CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog lists 9 entries for Red Hat as of catalog version 2026.11.06, released November 6, 2026. The newest was added August 26, 2026, and the latest federal due date is September 9, 2026. CISA marks 4 of them as known ransomware use.

Updated

entries in the catalog
9
newest addition
August 26, 2026
latest federal due date
September 9, 2026
marked known ransomware use
4

Directory record

Website
www.redhat.com
Categories
Software supply chain security (primary), Vulnerability management
Headquarters
HQ not established
Founded
Not established
Ownership
Ownership not established
Company record
Red Hat on CISO Tribune

Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.

KEV entries, newest first

Filed by CISA under the name “Red Hat”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

  1. Added August 26, 2026

    CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

    Automatic Bug Reporting Tool

    Due September 9, 2026

  2. Added August 26, 2026

    CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability

    Libuser

    Due September 9, 2026

  3. Added September 28, 2023

    CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

    JBoss RichFaces Framework

    Due October 19, 2023

  4. Added May 12, 2023

    CVE-2021-3560 Red Hat Polkit Incorrect Authorization Vulnerability

    Polkit

    Due June 2, 2023

  5. Added June 27, 2022

    CVE-2021-4034 Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

    Polkit · known ransomware use

    Due July 18, 2022

  6. Added May 25, 2022

    CVE-2010-1428 Red Hat JBoss Information Disclosure Vulnerability

    JBoss · known ransomware use

    Due June 15, 2022

  7. Added May 25, 2022

    CVE-2010-0738 Red Hat JBoss Authentication Bypass Vulnerability

    JBoss · known ransomware use

    Due June 15, 2022

  8. Added December 10, 2021

    CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution Vulnerability

    JBoss Application Server · known ransomware use

    Due June 10, 2022

  9. Added December 10, 2021

    CVE-2010-1871 Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability

    JBoss Seam 2

    Due June 10, 2022

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.

On Daily CISO, newest first

  1. Weekly archive · Dec 22 – Dec 28, 2025

    Nissan Discloses Impact From Red Hat GitLab Breach

  2. Weekly archive · Sep 29 – Oct 5, 2025

    Crimson Collective Claims Breach of Red Hat Consulting GitLab

Sources

  1. Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
  2. Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
  3. CISO Tribune, vendor directory record for Red Hat, published November 8, 2026