CVE-2026-5422 is a critical vulnerability impacting Red Hat Migration Toolkit for Applications (MTA) before version 2.18.2. The vulnerability encompasses a broad range of weaknesses (including CWE-22, CWE-79, CWE-502, CWE-606, among others), indicating potential issues such as path traversal, cross-site scripting, deserialization flaws, and improper authorization. The vendor has released a security advisory (RHSA-2026:43038) with a patch that fixes these issues. The advisory lists numerous bug fixes and improvements related to UI, analysis, and security. No active exploitation has been reported. The vulnerability affects the MTA product used for application modernization on hybrid cloud environments with Red Hat OpenShift.

The vulnerability is rated critical, implying that successful exploitation could lead to severe consequences such as unauthorized access, bypassing security controls, or executing malicious code within the MTA environment. Given the wide range of CWEs involved, impacts may include unauthorized file access, injection attacks, denial of service, or privilege escalation. However, no active exploits have been observed in the wild to date.

A patch is available and should be applied promptly to affected versions of Red Hat Migration Toolkit for Applications prior to 2.18.2. The vendor advisory RHSA-2026:43038 provides the official fix and instructions. Ensure all previously released errata relevant to your system are applied before updating. No additional mitigations are specified beyond applying the official update.