Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Red Hat Ansible Automation Platform provides an enterprise framework for
building, deploying and managing IT automation at scale. IT Managers can
provide top-down guidelines on how automation is applied to individual
teams, while automation developers retain the freedom to write tasks that
leverage existing knowledge without the overhead. Ansible Automation
Platform makes it possible for users across an organization to share, vet,
and manage automation content by means of a simple, powerful, and agentless
language.

CVE-2025-14025 is a security flaw in Red Hat Ansible Automation Platform (AAP) where read-only scoped OAuth2 API tokens, enforced at the gateway level, can perform write operations on backend services such as Controller, Hub, and EDA. This bypass occurs because the gateway does not properly restrict write operations for tokens intended to be read-only. The exploitability is limited by the permissions assigned to the user account associated with the token, making the impact dependent on the organization's RBAC policies. Attackers with tokens linked to users with elevated permissions could create or update execution environments, projects, or run job templates. Red Hat classifies this vulnerability as Important rather than Critical, emphasizing the need for careful token and permission management. No official fix has been released yet, but defense-in-depth strategies are recommended.

Detailed information about Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update affecting Red Hat Product Security Red Ha

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/errata/RHSA-2026:0408

https://access.redhat.com/security/cve/CVE-2025-14025

https://access.redhat.com/security/cve/CVE-2025-68664

https://access.redhat.com/security/updates/classification/

https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/html/release_notes/patch_releases

Canonical URL

https://access.redhat.com/errata/RHSA-2026:0409

https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).

CVE-2025-14025 is a vulnerability identified in Red Hat Ansible Automation Platform (AAP) version 2.5 running on RHEL 8. The issue stems from improper enforcement of OAuth2 API token scopes. Specifically, read-only scoped tokens, which should restrict API access to non-modifying operations, are enforced only at the Gateway level for Gateway-specific operations. However, this enforcement does not extend properly to backend services such as the Controller, Hub, and Event-Driven Automation (EDA) components. As a result, an attacker possessing a read-only token can perform unauthorized write operations on these backend services. The exploitability is limited by the role-based access control (RBAC) policies configured within the platform, meaning that the attacker’s effective permissions depend on the assigned roles. The vulnerability does not require user interaction and can be exploited remotely over the network, but it requires low privileges (a read-only token). The CVSS v3.1 base score is 8.5, indicating high severity with critical impacts on confidentiality, integrity, and availability. No public exploits are known at this time, but the flaw presents a significant risk to environments relying on Ansible Automation for orchestration and configuration management. The vulnerability was reserved in December 2025 and published in January 2026, with no patch links currently available, emphasizing the need for vigilance and proactive mitigation.

Detailed information about CVE-2025-14025: Incorrect Execution-Assigned Permissions in Red Hat Red Hat Ansible Automation Platform 2 affecting Red Hat Red Hat A

CVE-2025-14025: Incorrect Execution-Assigned Permissions in Red Hat Red Hat Ansible Automation Platform 2 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-14025: Incorrect Execution-Assigned Permissions in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8


Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release UpdateCVE-2025-14025 0 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. CriticalVulnerability#gcve #csaf #cve-2025-14025 Join the discussion	GCVE Database	01/08/2026, 19:41:55 UTC Added: 05/26/2026, 20:58:48 UTC
CVE-2025-14025: Incorrect Execution-Assigned Permissions in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8CVE-2025-14025 0 A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC). HighVulnerabilityUnited StatesGermanyJapan+6#cve #cve-2025-14025 Join the discussion	CVE Database V5	01/08/2026, 13:44:04 UTC Added: 01/08/2026, 14:05:31 UTC

Threats Tagged 'cve-2025-14025'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-14025'

Lead Pen Test Professional