CVE-2026-81999

Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Aem 6.5 Forms Jee Aem 6.5 Lts Forms Jee

CVE-2026-75744

Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed

Vendors

Adobe

Products

Aem 6.5 Forms Jee Aem 6.5 Lts Forms Jee

CVE-2026-63104

Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks. Attackers can send requests to the PATCH /api/task/bulk endpoint, which verifies only workspace membership without calling the role-based permission check enforced on all other task endpoints, to permanently delete all tasks or modify task status, priority, assignee, due date, and labels in a workspace.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Usekaneo

Products

Kaneo

CVE-2026-87121

Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application

lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Lwip

Products

Tcp/ip Stack Mqtt

CVE-2026-81657

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Guardium Data Protection

CVE-2026-93749

source-map-js through 1.2.1 Event Loop Denial of Service

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

7rulnik

Products

Source-map-js

CVE-2026-84643

automation-controller: automation-controller-container: automation-controller: missing use_role authorization on the project signature validation credential foreign key allows a project administrator to bind and use another organization's credential cross-tenant

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. A project has a signature validation credential foreign key used to validate signed project content. Unlike the project's SCM credential, the authorization logic does not verify that the requesting user has use permission on the referenced credential, and the API field has no validator or type restriction. An authenticated user holding only the organization project administrator role can therefore bind an arbitrary credential belonging to another organization, by its identifier, when creating or updating a project. The controller discloses that credential's name and type in the project's summary information and, during project synchronization, decrypts the bound credential and uses it in the attacker-controlled project's update, allowing a cross-tenant authorization boundary violation and information disclosure.

CVSS 3.1 · 5.0 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84689

automation-controller: automation-controller-container: automation-controller: bulk job launch allows setting a workflow node's job reference to an arbitrary unified job, enabling a low-privileged user to cancel and read metadata of jobs in other organizations

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job -- writable and does not include it in the permission validation performed for the other node fields. An authenticated user with permission to execute a single job template can submit a bulk job launch whose node references the identifier of any unified job in any organization, including jobs they cannot access. The node then exposes that job's metadata, and cancelling the attacker's workflow cancels the referenced job through the workflow cancellation cascade, without any per-job authorization check. Repeated, this allows a low-privileged user to cancel running jobs, project and inventory syncs, ad hoc commands, and system jobs across all organizations, denying automation service platform-wide.

CVSS 3.1 · 8.5 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84692

automation-controller: automation-controller-container: automation-controller: workflow job template node execute permission check bypassed by creating a node with a null unified_job_template and then patching it, allowing a single workflow-admin to execute any other tenant's job template with the victim's credentials (cross-tenant privilege escalation)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The execute-permission check on a workflow job template node's unified job template is skipped when the node's currently stored unified job template is empty: the check inspects only the existing value, not the incoming one, and a node can be created without a unified job template. An authenticated user who holds admin permission on a single workflow job template can create an empty node and then patch it to reference any job template, project, inventory source, system job, or workflow on the platform -- including ones in other organizations that they cannot otherwise read or launch. Running their own workflow then executes the victim template with the victim's attached credentials, inventory and project, resulting in cross-organization privilege escalation to arbitrary automation execution. The patch response also discloses the victim template's name and description.

CVSS 3.1 · 8.5 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84709

automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration count, output size, or execution time. An authenticated superuser can submit a credential type whose injector contains deeply nested loops or large string operations, consuming CPU and wall-clock time in the web worker until it is killed by the request timeout; issuing enough concurrent requests places all web workers into a kill-and-respawn loop, making the Controller API and UI unavailable for the duration of the attack. Additionally, certain template constructs raise exception types that the validator does not handle, resulting in an unhandled server error (HTTP 500) instead of a clean validation error. The rendering sandbox prevents code execution, so there is no confidentiality or integrity impact.

CVSS 3.1 · 4.9 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84707

automation-controller: automation-controller-container: automation-controller: host_filter SmartFilter ORM traversal exposes JobEvent/AdHocCommandEvent event_data and stdout to users without permission on the job, enabling blind character-by-character extraction of job output (cross-tenant information disclosure)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The host_filter query parameter on the hosts list API is parsed into a raw Django ORM filter whose lookup path is validated only against a sensitive-field blocklist, with no authorization check on the database relations it traverses. Because job event and ad-hoc command output fields are not on that blocklist, an authenticated user holding only the Read role on an inventory can construct filters that traverse into the output of jobs they have no permission to view and use the returned host count as a boolean oracle. Using regular-expression lookups, the attacker can extract, character by character, the output (which routinely contains plaintext credentials, tokens, and command results) of jobs and ad-hoc commands belonging to other organizations, resulting in cross-tenant disclosure of job output

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84686

automation-controller: automation-controller-container: automation-controller: notification template password fields can be decrypted by a notification-template administrator by replaying encrypted values across subfields, exposing plaintext Slack, PagerDuty, Twilio, AWS SNS and Grafana credentials

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Notification template password fields are encrypted with a key derived from the secret key, the object primary key, and the field name, but not the subfield name, and the API returns the full ciphertext of a password subfield after the notification type is changed to one that does not define that subfield. A user with administrative access to a single notification template, but without any wider privilege, can switch the template type to reveal the stored ciphertext, replant that ciphertext into a webhook password field pointing at a server they control, and trigger a test notification. The controller decrypts the replayed ciphertext to the original plaintext and sends it to the attacker's server in an HTTP Basic authorization header, allowing recovery of Slack, PagerDuty, Twilio, AWS SNS, and Grafana credentials the administrator was only permitted to use, not read.

CVSS 3.1 · 7.6 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84711

automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials on control-plane deployments) leading to full AAP and Kubernetes-namespace compromise

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a `git checkout`/`git fetch` command line as bare arguments with no end-of-options separator. An authenticated user permitted to create or edit a project can set the SCM branch to a git option such as `--pathspec-from-file=<path>`, causing git to read an arbitrary file on the synchronization host and reflect its contents back through the project-update output. Because project synchronization runs on the control-plane host on default OpenShift Operator deployments, an attacker can read the control-plane Kubernetes ServiceAccount token, the Controller SECRET_KEY, and the database credentials, leading to full compromise of the Automation Platform and its Kubernetes namespace. System administrator privileges are not required and the impact crosses tenants.

CVSS 3.1 · 9.9 Critical EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84644

automation-controller-container: automation-controller: automation-controller: server-side request forgery via the Thycotic Secret Server external credential plugin test endpoint (caller-controlled server_url, backend executed in the controller web process)

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Thycotic Secret Server external credential plugin passes a user-supplied server URL to its SDK without validating the scheme, host, or IP range, and the plugin backend is executed synchronously within the automation controller web process. Using the external credential test endpoint, a user who holds only the use role on such a credential can override the stored server URL with an arbitrary internal address, causing the control plane to issue requests to internal services. Although the response is a generic error, response timing reveals whether internal hosts and ports are reachable, enabling internal network reconnaissance and a blind request-forgery primitive from the control plane, and each request can hold a web worker, affecting availability.

CVSS 3.1 · 7.4 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84475

automation-controller: automation-controller-container: automation-controller: InventorySource.source_vars lacks prevent_search, enabling zero-privilege cross-tenant extraction of inline inventory-plugin credentials via the credential_types FieldLookupBackend count-oracle

automation-controller: InventorySource.source_vars lacks prevent_search, enabling zero-privilege cross-tenant extraction of inline inventory-plugin credentials via the credential_types FieldLookupBackend count-oracle

CVSS 3.1 · 7.7 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-84678

automation-controller: automation-controller-container: automation-controller: GALAXY_TASK_ENV setting is not filtered for dynamic-linker / interpreter environment variables, allowing a system administrator to achieve code execution in the project-update execution environment

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The GALAXY_TASK_ENV setting, whose values are added to the environment of the ansible-galaxy commands run during project updates, is not validated to exclude dynamic-linker and interpreter environment variables such as LD_PRELOAD and PYTHONPATH, unlike the sibling AWX_TASK_ENV setting. A user with the system administrator role can set these variables to point at a file placed inside a project checkout on the shared projects volume, causing arbitrary native or Python code to execute inside the project synchronization execution environment on the control plane. This yields read and write access to every organization's project content and to injected Galaxy server tokens, resulting in a cross-tenant compromise of the automation content supply chain.

CVSS 3.1 · 8.7 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-84708

automation-controller: automation-controller-container: automation-controller: container group pod_spec_override mints the automation-controller ServiceAccount token and mounts control-plane namespace secrets into job pods, bypassing automountServiceAccountToken:false (control-plane secret and identity compromise)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. A user with the delegated Instance Group Admin role on a container group can set a free-form pod specification override that is deep-merged, without filtering, into every job pod launched on that group. The only hardening applied is forcing automountServiceAccountToken to false, which does not remove an explicitly declared projected serviceAccountToken volume or secret volume mounts. A non-superuser can therefore cause the kubelet to mint a ServiceAccount token for the control-plane automation-controller service account into the job container and mount arbitrary secrets from the control-plane namespace, obtaining the control-plane service-account identity on the Kubernetes API and cleartext control-plane secrets (including the platform database password and Django SECRET_KEY), leading to full platform data compromise.

CVSS 3.1 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84703

automation-controller: automation-controller-container: automation-controller: execution environment credential foreign key is not use-permission checked, allowing an organization execution-environment admin to bind and disclose another organization's container registry credential (cross-tenant credential disclosure)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates only the organization and the credential kind. An authenticated user who is an execution-environment admin of one organization can associate a container registry credential belonging to a different organization -- one they cannot otherwise read, list, or use -- to an execution environment they control. When a job runs with that execution environment, the controller decrypts the foreign credential's registry password and supplies it to the container runtime, disclosing another organization's registry credentials across the tenant boundary.

CVSS 3.1 · 6.8 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84638

automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read (view) the instance group, rather than that they hold use permission on it, unlike every other instance group assignment in the product. An authenticated user with read-only visibility of an instance group -- for example a system auditor -- can attach a use-restricted instance group, including the control plane group or another tenant's container group, to a schedule or workflow node they control. Their playbook then executes on the control plane node or within another tenant's execution environment, leading to privilege escalation and, in the control plane case, full compromise of the platform.

CVSS 3.1 · 9.9 Critical EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-84680

automation-controller: automation-controller-container: automation-controller: organization galaxy credential attachment checks only read permission on the credential, allowing an organization admin with read-only visibility to bind and server-side-use another tenant's Automation Hub API token

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a Galaxy or Automation Hub credential to an organization through the galaxy_credentials relationship endpoint, the controller verifies only that the requesting user can read the credential, rather than that they hold use permission on it, unlike other credential consumption in the product. An authenticated user who administers one organization and has read-only visibility of a credential in another organization -- for example a platform auditor -- can bind that foreign credential to their own organization. On the next project synchronization the controller decrypts the credential server-side and uses its token to authenticate to the credential owner's Automation Hub, allowing cross-tenant use of another organization's secret.

CVSS 3.1 · 4.1 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform