CVE-2025-23366: Red Hat Hal Management Console

Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.

Affected products

• Red Hat Hal Management Console: before 3.7.7 (fixed in 3.7.7)

Published 2025-01-14. Last modified 2026-08-19.