Red Hat Advanced Cluster Security 4.9 vulnerabilities

3 CVEs affecting Red Hat Advanced Cluster Security 4.9, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-9165, published 2026-07-06.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-35469, published 2026-04-16. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before…
• CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
• CVE-2026-9165, published 2026-07-06. High severity, CVSS 7.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a…