Suse Harvester vulnerabilities

3 CVEs affecting Suse Harvester, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-71261, published 2026-06-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-62877, published 2026-01-08. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster…
CVE-2025-71261, published 2026-06-16. High severity, CVSS 8.6. EPSS: 0.2% chance of exploitation in the next 30 days. An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a…
CVE-2025-67860, published 2026-02-25. Low severity, CVSS 3.8. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, potentially exposing sensitive…