CVE-2026-84292VulnerabilityPublished 30 Sep 2026Updated 29 Oct 2026

Red Hat Security Advisory: Red Hat Edge Manager Version 1.3.1 Security Update

Affects Red HatSource GCVE Database

Compare

Not known to be exploited.

Data as of 29 Oct 2026, 10:37 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 30 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

The Red Hat advisory does not explicitly mention a fixed version or patch availability for this vulnerability. Organizations using Red Hat Edge Manager should monitor Red Hat's security updates and apply any forthcoming patches promptly once available.

Description

Red Hat Edge Manager (RHEM) version 1.3.1 received a security update addressing a vulnerability identified as CVE-2026-84292. RHEM facilitates scalable and secure management of edge devices and applications, supporting image-mode RHEL and container workloads on Podman/Docker or Kubernetes. The update is part of Red Hat's ongoing efforts to provide flexible edge deployment options, including standalone and plugin integrations with Red Hat Advanced Cluster Management and Ansible Automation Platform. No fixed versions are explicitly stated in the advisory, and no known exploits are reported in the wild.

Impact

The vulnerability is rated as high severity, indicating a significant security risk if exploited. CWE-140 suggests the issue involves buffer over-read, which could potentially lead to information disclosure or application instability. However, no known exploits are currently reported in the wild, and the advisory does not detail specific impacts beyond the classification and severity rating.

Summary

CVE-2026-84292 is a security vulnerability affecting Red Hat Edge Manager version 1.3.1, a solution designed for managing edge devices and container workloads securely and at scale. The advisory highlights RHEM's capabilities in managing large fleets of devices with remote configuration, over-the-air updates, and telemetry collection. The vulnerability is classified under CWE-140, which relates to buffer over-read issues. The Red Hat advisory does not specify fixed versions or detailed exploit information but provides documentation links for enabling and managing RHEM. No active exploitation has been reported.

CWE-140Improper Neutralization of Delimiters (opens in a new tab)
Base weakness
The product does not neutralize or incorrectly neutralizes delimiters.
Implementation · Input Validation
Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Output Encoding
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
Server Side Request Forgery Prevention (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
Cross Site Scripting Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.1 (opens in a new tab)
V5.2.2 (opens in a new tab)
Attack patterns
Command Delimiters (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 29 Oct 2026, 10:07 UTC

WeaknessesCWE-140

Technical details

References

Community reviews

Related threats