This security advisory from Red Hat addresses multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.15.3 container images. The product facilitates unified visibility and management of Kubernetes clusters and applications across public and private clouds. The advisory references a collection of CVEs including CVE-2025-48431 and 19 others, covering various weaknesses such as those categorized under CWEs like CWE-763, CWE-787, CWE-201, and others. The CVSS vector for CVE-2025-48431 indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability. The advisory notes new features, enhancements, bug fixes, and updated container images but does not explicitly list individual vulnerability fixes or patch versions. The vendor advisory directs users to apply this update and any previously released errata relevant to their system.

The vulnerabilities collectively have a high severity impact, primarily affecting availability of the Red Hat Advanced Cluster Management for Kubernetes service. The CVSS vector for the primary CVE indicates that an attacker can exploit the vulnerability remotely without privileges or user interaction, potentially causing denial of service or disruption. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported at this time.

A security update to Red Hat Advanced Cluster Management for Kubernetes version 2.15.3 is available and includes fixes for the reported vulnerabilities. Users should apply this update along with any previously released relevant errata to ensure their systems are protected. The vendor advisory does not specify individual patches but indicates that the updated container images contain the necessary fixes. Follow Red Hat's official guidance for applying updates: https://access.redhat.com/articles/11258.