Red Hat Enterprise Linux vulnerabilities: known CVEs & security history
Red Hat · Operating System · 461 tracked CVEs · 11 actively exploited · updated October 2026 · what is a CVE? →
This is the full list of known vulnerabilities (CVEs) across all Red Hat Enterprise Linux release lines — 461 in total, with 11 actively exploited in the wild. A CVE here doesn't mean your version is affected — check Red Hat Enterprise Linux's current status and the safe version to run.
Known Red Hat Enterprise Linux CVEs
Actively-exploited and most-severe first. Showing the top 80 of 461. Open any CVE for full details.
| CVE | Severity | CVSS | EPSS | Year |
|---|---|---|---|---|
| CVE-2021-40438⚡ exploited | critical | 9 | 100% | 2021 |
| CVE-2025-31277⚡ exploited | high | 8.8 | 2% | 2025 |
| CVE-2019-8720⚡ exploited | high | 8.8 | 2% | 2023 |
| CVE-2026-31431⚡ exploited | high | 7.8 | 100% | 2026 |
| CVE-2023-4911⚡ exploited | high | 7.8 | 64% | 2023 |
| CVE-2021-4034⚡ exploited | high | 7.8 | 95% | 2022 |
| CVE-2015-5287⚡ exploited | high | 7.8 | 3% | 2015 |
| CVE-2026-34486⚡ exploited | high | 7.5 | 99% | 2026 |
| CVE-2023-44487⚡ exploited | high | 7.5 | 100% | 2023 |
| CVE-2015-5477⚡ exploited | high | 7.5 | 92% | 2015 |
| CVE-2015-3246⚡ exploited | high | 7.4 | 9% | 2015 |
| CVE-2026-53006 | critical | 9.8 | 0% | 2026 |
| CVE-2026-53002 | critical | 9.8 | 0% | 2026 |
| CVE-2024-12084 | critical | 9.8 | 73% | 2025 |
| CVE-2021-20232 | critical | 9.8 | 3% | 2021 |
| CVE-2021-20231 | critical | 9.8 | 4% | 2021 |
| CVE-2019-17267 | critical | 9.8 | 5% | 2019 |
| CVE-2019-16942 | critical | 9.8 | 6% | 2019 |
| CVE-2019-16335 | critical | 9.8 | 5% | 2019 |
| CVE-2019-14540 | critical | 9.8 | 11% | 2019 |
| CVE-2019-14379 | critical | 9.8 | 8% | 2019 |
| CVE-2018-11307 | critical | 9.8 | 6% | 2019 |
| CVE-2019-10160 | critical | 9.8 | 5% | 2019 |
| CVE-2019-9636 | critical | 9.8 | 8% | 2019 |
| CVE-2018-14719 | critical | 9.8 | 10% | 2019 |
| CVE-2018-14718 | critical | 9.8 | 13% | 2019 |
| CVE-2017-15095 | critical | 9.8 | 8% | 2018 |
| CVE-2017-5645 | critical | 9.8 | 90% | 2017 |
| CVE-2026-11861 | critical | 9.6 | 0% | 2026 |
| CVE-2026-1709 | critical | 9.4 | 5% | 2026 |
| CVE-2026-96659 | critical | 9.1 | 0% | 2026 |
| CVE-2026-44172 | critical | 9.1 | 1% | 2026 |
| CVE-2019-20445 | critical | 9.1 | 13% | 2020 |
| CVE-2019-20444 | critical | 9.1 | 9% | 2020 |
| CVE-2026-4408 | critical | 9 | 3% | 2026 |
| CVE-2026-4480 | critical | 9 | 14% | 2026 |
| CVE-2026-96658 | high | 8.8 | 1% | 2026 |
| CVE-2026-59851 | high | 8.8 | 0% | 2026 |
| CVE-2026-5136 | high | 8.8 | 0% | 2026 |
| CVE-2023-5178 | high | 8.8 | 10% | 2023 |
| CVE-2021-3518 | high | 8.8 | 22% | 2021 |
| CVE-2019-3857 | high | 8.8 | 6% | 2019 |
| CVE-2019-3856 | high | 8.8 | 6% | 2019 |
| CVE-2019-3855 | high | 8.8 | 9% | 2019 |
| CVE-2017-5436 | high | 8.8 | 2% | 2018 |
| CVE-2026-13097 | high | 8.7 | 1% | 2026 |
| CVE-2026-28369 | high | 8.7 | 1% | 2026 |
| CVE-2026-28368 | high | 8.7 | 1% | 2026 |
| CVE-2026-102560 | high | 8.6 | 0% | 2026 |
| CVE-2026-102559 | high | 8.6 | 0% | 2026 |
| CVE-2026-102558 | high | 8.6 | 0% | 2026 |
| CVE-2026-102557 | high | 8.6 | 0% | 2026 |
| CVE-2026-102556 | high | 8.6 | 0% | 2026 |
| CVE-2023-46847 | high | 8.6 | 88% | 2023 |
| CVE-2021-3517 | high | 8.6 | 17% | 2021 |
| CVE-2026-59090 | high | 8.4 | 1% | 2026 |
| CVE-2023-40547 | high | 8.3 | 5% | 2024 |
| CVE-2026-12541 | high | 8.2 | 1% | 2026 |
| CVE-2026-12540 | high | 8.2 | 1% | 2026 |
| CVE-2026-102555 | high | 8.2 | 0% | 2026 |
| CVE-2026-19550 | high | 8.2 | 0% | 2026 |
| CVE-2026-35091 | high | 8.2 | 1% | 2026 |
| CVE-2026-0966 | high | 8.2 | 1% | 2026 |
| CVE-2022-1665 | high | 8.2 | 0% | 2022 |
| CVE-2026-42055 | high | 8.1 | 7% | 2026 |
| CVE-2026-9256 | high | 8.1 | 10% | 2026 |
| CVE-2024-6387 | high | 8.1 | 100% | 2024 |
| CVE-2024-5154 | high | 8.1 | 1% | 2024 |
| CVE-2023-4853 | high | 8.1 | 1% | 2023 |
| CVE-2021-20305 | high | 8.1 | 2% | 2021 |
| CVE-2026-3012 | high | 8 | 0% | 2026 |
| CVE-2026-1961 | high | 8 | 1% | 2026 |
| CVE-2024-1488 | high | 8 | 0% | 2024 |
| CVE-2026-59087 | high | 7.8 | 0% | 2026 |
| CVE-2026-42170 | high | 7.8 | 0% | 2026 |
| CVE-2026-66758 | high | 7.8 | 0% | 2026 |
| CVE-2026-53153 | high | 7.8 | 0% | 2026 |
| CVE-2026-53145 | high | 7.8 | 0% | 2026 |
| CVE-2026-53009 | high | 7.8 | 0% | 2026 |
| CVE-2026-53000 | high | 7.8 | 0% | 2026 |
381 older / lower-severity CVEs not shown — see Red Hat Enterprise Linux's full record.
Is my Red Hat Enterprise Linux version affected?
The list above spans every release. To know whether your version is affected — and the minimum safe version to upgrade to — check it directly.
Check your Red Hat Enterprise Linux version → · Monitor Red Hat Enterprise Linux for new CVEs →
Red Hat Enterprise Linux vulnerabilities — frequently asked
How many known vulnerabilities does Red Hat Enterprise Linux have?
IsItPatched tracks 461 CVEs for Red Hat Enterprise Linux, 11 of which are actively exploited (CISA KEV). 26 are critical-severity and 180 high-severity. These span every release line — what matters is whether the version you run is affected.
Does Red Hat Enterprise Linux have any actively-exploited vulnerabilities?
Yes — 11 Red Hat Enterprise Linux CVEs are in CISA's Known Exploited Vulnerabilities catalog, meaning they are confirmed exploited in the wild (2 linked to ransomware). Patch these as a priority.
What is the most severe Red Hat Enterprise Linux vulnerability?
Among tracked issues, CVE-2021-40438 (CRITICAL, CVSS 9), which is actively exploited, ranks highest — a Server-side request forgery (SSRF) weakness.
Is Red Hat Enterprise Linux safe to use?
It depends on the version. The latest supported Red Hat Enterprise Linux release (10.2) clears the known issues; older versions may still be affected. Check the exact version you run for a verdict.
CVE data aggregated from NVD, CISA KEV and EPSS (FIRST.org). Related: Red Hat Enterprise Linux security status · Red Hat Enterprise Linux end-of-life · actively-exploited CVEs. Always verify against Red Hat's advisories — see our disclaimer.