Linux · 
Red Hat · Security advisory · November 12, 2026
Red Hat · Security advisory · November 12, 2026RHSA-2026:99018: Security update for 13 packages
RHSA-2026:99018, released November 12, 2026, fixes 21 CVEs across 13 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
21
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0076
55th percentile
Priority of the 21 CVEs
Patch now 0
Urgent 1
High 20
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| eap8-apache-sshd | RHEL 10 | 2.20.0-1.redhat_00002.1.el10eap |
| eap8-bouncycastle | RHEL 10 | 1.86.0-1.redhat_00001.1.el10eap |
| eap8-eap-product-conf-parent | RHEL 10 | 801.9.1-1.GA_redhat_00002.1.el10eap |
| eap8-ironjacamar | RHEL 10 | 3.1.1-1.Final_redhat_00001.1.el10eap |
| eap8-jackson-jaxrs-providers | RHEL 10 | 2.18.11-1.redhat_00001.1.el10eap |
| eap8-jackson-modules-base | RHEL 10 | 2.18.11-1.redhat_00001.1.el10eap |
| eap8-jackson-modules-java8 | RHEL 10 | 2.18.11-1.redhat_00001.1.el10eap |
| eap8-mod_cluster | RHEL 10 | 2.1.1-1.Final_redhat_00001.1.el10eap |
| eap8-neethi | RHEL 10 | 3.2.4-1.redhat_00001.1.el10eap |
| eap8-wildfly | RHEL 10 | 8.1.9.1-1.GA_redhat_00006.1.el10eap |
| eap8-wildfly-http-client | RHEL 10 | 2.1.5-1.Final_redhat_00001.1.el10eap |
| eap8-wildfly-javadocs | RHEL 10 | 8.1.1-15.GA_redhat_00052.1.el10eap |
| eap8-ws-commons-XmlSchema | RHEL 10 | 2.3.3-1.redhat_00001.1.el10eap |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-77185 | apache-sshd: Asynchronous authentication can bypass signature verification (bsc#1283357). | 9.1 | 0.0040 | None reported |
| High | CVE-2026-91863 | eap8-jackson-modules-base: A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and... | 7.5 | 0.0076 | None reported |
| High | CVE-2026-91864 | eap8-apache-sshd: A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into... | 7.5 | 0.0074 | None reported |
| High | CVE-2026-91865 | eap8-apache-sshd: A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponen... | 7.5 | 0.0074 | None reported |
| High | CVE-2026-91866 | eap8-apache-sshd: A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of w... | 7.5 | 0.0074 | None reported |
| High | CVE-2026-68498 | jackson-annotations: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641). | 7.5 | 0.0065 | None reported |
| High | CVE-2026-89407 | jackson-annotations: Optimize NumberInput.looksLikeValidNumber (bsc#1282645). | 7.5 | 0.0063 | None reported |
| High | CVE-2026-58060 | bouncycastle: HSS public-key level count unbounded, enabling huge allocation on verify (bsc#1272714). | 7.5 | 0.0062 | None reported |
| High | CVE-2026-89425 | jackson-annotations: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for | 7.5 | 0.0053 | None reported |
| High | CVE-2026-102495 | eap8-apache-sshd: Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make p... | 7.5 | 0.0053 | None reported |
| High | CVE-2026-102496 | eap8-apache-sshd: Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malic... | 7.5 | 0.0053 | None reported |
| High | CVE-2026-91777 | jackson-annotations: Collection/Map deserializers (bsc#1282492 | 7.5 | 0.0049 | None reported |
| High | CVE-2026-59645 | bouncycastle: OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (bsc#1272725). | 7.5 | 0.0041 | None reported |
| High | CVE-2026-93994 | apache-sshd: Repeated-publickey policy bypass on server (bsc#1283352). | 8.1 | 0.0030 | None reported |
| High | CVE-2026-59642 | bouncycastle: CMS AuthenticatedData content not bound to MAC when authAttrs present (bsc#1272722). | 7.5 | 0.0030 | None reported |
| High | CVE-2026-58061 | bouncycastle: CCM-family modes write plaintext to caller buffer before tag check (bsc#1272715). | 7.5 | 0.0028 | None reported |
| High | CVE-2026-12977 | eap8-apache-sshd: A flaw was found in the deployment-operation family of WildFly Core | 8.8 | 0.0025 | None reported |
| High | CVE-2026-59639 | bouncycastle: CMS verifySignatures returns true for SignedData with zero signers (bsc#1272719). | 7.5 | 0.0024 | None reported |
| High | CVE-2026-12802 | bouncycastle: CMS AuthEnvelopedData fails to enforce tag-length on decryption (bsc#1272702). | 7.5 | 0.0020 | None reported |
| High | CVE-2026-71889 | bouncycastle: skipped leaf certificate evaluation in checkNameConstraints can cause X.509 name constraint bypasses | 7.5 | 0.0017 | None reported |
| High | CVE-2026-71887 | bouncycastle: missing primary key back-signature validation on subkeys can cause signature misattribution and trust | 7.5 | 0.0009 | None reported |
Showing 1 to 21 of 21
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.