The Red Hat security advisory RHSA-2026:37382 provides an update for Red Hat Hardened Images RPMs, specifically for OpenSSH packages version 10.4p1-1.hum1 on aarch64 and x86_64 architectures. The update addresses seven CVEs (CVE-2026-59995 to CVE-2026-60002) involving various security weaknesses categorized under CWEs such as CWE-22 (Path Traversal), CWE-88 (Argument Injection), CWE-909 (Integrity Check Bypass), CWE-358 (Improperly Controlled Modification of Object Prototype Attributes), CWE-307 (Improper Restriction of Excessive Authentication Attempts), and CWE-825 (Expansion of Privileges). The advisory does not provide detailed technical descriptions or CVSS scores for these vulnerabilities. No known exploits have been reported in the wild. The update is a bug fix and enhancement release for hardened OpenSSH RPMs.

The vulnerabilities addressed affect OpenSSH components within Red Hat Hardened Images, potentially allowing attackers to exploit issues related to path traversal, argument injection, authentication bypass, privilege escalation, and related security weaknesses. The exact impact on confidentiality, integrity, or availability is not detailed. No known active exploitation has been reported, but the advisory classifies the severity as high, indicating significant potential risk if unpatched.

Red Hat has released updated OpenSSH RPM packages (version 10.4p1-1.hum1) for affected architectures. Users of Red Hat Hardened Images should apply this update promptly to remediate the identified vulnerabilities. Detailed update instructions and packages are available at https://images.redhat.com/. Since this is not a cloud service, remediation requires manual update by administrators. Patch status is confirmed by the vendor advisory indicating an official fix is available.