Red Hat JBoss Web Server 6.2.0 is a security update that addresses three vulnerabilities in Apache Tomcat components bundled within the product. The fixed issues include a security constraint bypass for CGI scripts (CVE-2025-46701), a session fixation vulnerability via the rewrite valve (CVE-2025-55668), and a console manipulation vulnerability (CVE-2025-55754). These vulnerabilities are documented in Red Hat Security Advisory RHSA-2026:2740. The update replaces version 6.1.3 and is available for RHEL 8, 9, and 10. Red Hat rates the security impact as moderate. No CVSS base scores are provided in the advisory, and no known exploits in the wild have been reported.

The vulnerabilities fixed in this release could allow an attacker to bypass security constraints on CGI scripts, perform session fixation attacks via the rewrite valve, or manipulate the console in Apache Tomcat components. These issues could potentially lead to unauthorized access or session hijacking in affected deployments. Red Hat rates the overall impact as moderate. No known exploits in the wild have been reported at this time.

Red Hat has released Red Hat JBoss Web Server 6.2.0 as a security update that addresses these vulnerabilities. Users should apply this update to replace version 6.1.3. Before applying the update, ensure all previously released errata relevant to the system have been applied. Detailed update instructions are available in the Red Hat advisory. Since this is an on-premises product, remediation requires manual update by the user. Patch status is confirmed by the vendor advisory RHSA-2026:2740.