Red Hat Satellite 6.16.4 addresses two security vulnerabilities: CVE-2025-27610, a Local File Inclusion vulnerability in the Rack::Static component of rubygem-rack, and CVE-2025-27407, a remote code execution vulnerability in rubygem-graphql triggered by loading a crafted GraphQL schema. These vulnerabilities could allow an attacker to include local files or execute arbitrary code remotely. The advisory recommends upgrading to the updated packages that fix these bugs. The update is rated as Important by Red Hat Product Security. No CVSS score is provided in the advisory.

The Local File Inclusion vulnerability (CVE-2025-27610) could allow unauthorized access to local files on the system, potentially exposing sensitive information. The remote code execution vulnerability (CVE-2025-27407) could allow an attacker to execute arbitrary code remotely by loading a malicious GraphQL schema, potentially leading to full system compromise. Both vulnerabilities pose significant risks to systems managed by Red Hat Satellite prior to the update.

Red Hat has released updated packages for Red Hat Satellite 6.16.4 that fix these vulnerabilities. Users should apply these updates promptly. Before applying the update, ensure all previously released errata relevant to the system have been applied. Detailed update instructions are available in the Red Hat Satellite documentation. There is no indication that these vulnerabilities are mitigated by default or require no action; upgrading is the recommended remediation.