Red Hat Satellite 6.18.6 update addresses several security vulnerabilities affecting components used within the product. Notably, CVE-2026-25990 is an out-of-bounds write flaw in the Pillow Python imaging library triggered by specially crafted PSD images, potentially allowing arbitrary code execution or information disclosure. Additional fixes include CVE-2026-27830, an arbitrary code execution vulnerability via deserialization of crafted objects in the c3p0 library, and CVE-2026-32282, a symlink traversal issue in dynflow-utils that allows Root.Chmod to follow symlinks outside the intended root. Red Hat has released patches in Satellite 6.18.6 to remediate these issues. The vendor advisory confirms the availability of official fixes and provides detailed update instructions.

Successful exploitation of CVE-2026-25990 could lead to memory corruption resulting in arbitrary code execution or information disclosure when processing malicious PSD images. CVE-2026-27830 allows arbitrary code execution via deserialization of crafted objects, posing a critical risk. CVE-2026-32282 enables privilege escalation through symlink traversal during file permission changes. These vulnerabilities collectively pose a high security risk to affected Red Hat Satellite 6.18 systems if unpatched.

Apply the official Red Hat Satellite 6.18.6 update which includes patches for CVE-2026-25990, CVE-2026-27830, and CVE-2026-32282. Ensure all previously released errata relevant to your system are applied before updating. Follow Red Hat's documented update procedures at https://docs.redhat.com/en/documentation/red_hat_satellite/6.18/html/updating_red_hat_satellite/index. No alternative mitigations are noted; patching is the recommended and supported remediation.