This advisory covers multiple security fixes in Red Hat Satellite 6.18 for RHEL 9, specifically versions >=6.18.0 and <6.18.4. Vulnerabilities include: CVE-2025-61726 (memory exhaustion in query parameter parsing in net/url), CVE-2025-61729 (denial of service via crafted certificate in golang), CVE-2025-68121 (unexpected session resumption in crypto/tls), CVE-2026-0980 (remote code execution via malicious BMC username in rubyipmi), CVE-2026-1531 (man-in-the-middle due to insecure default SSL verification in foreman_kubevirt), CVE-2026-1961 (remote code execution via command injection in WebSocket proxy in foreman), and CVE-2026-4324 (denial of service and potential information disclosure via SQL injection in katello). Red Hat rates the update as having a Moderate security impact overall. The advisory provides detailed package updates and instructions for remediation.

The vulnerabilities collectively impact system availability, confidentiality, and integrity. Memory exhaustion and denial of service flaws can disrupt service availability. Remote code execution vulnerabilities allow attackers to execute arbitrary commands on affected systems, potentially leading to full system compromise. Man-in-the-middle vulnerability could allow interception and manipulation of communications. SQL injection may lead to denial of service and unauthorized data disclosure. These issues affect critical components of Red Hat Satellite, which is used for system provisioning and configuration management, thus potentially impacting enterprise infrastructure management.

Red Hat has released Red Hat Satellite 6.18.4 which addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their systems have been applied. Detailed update instructions are available in the Red Hat Satellite documentation. No additional mitigations are specified beyond applying the official update. Patch status is confirmed as an official fix in version 6.18.4.