Red Hat Ansible Automation Platform 2.5 vulnerabilities

4 CVEs affecting Red Hat Ansible Automation Platform 2.5, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-11807, published 2026-06-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-1615, published 2026-02-09. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to…
CVE-2026-11807, published 2026-06-23. Critical severity, CVSS 9.6. EPSS: 0.5% chance of exploitation in the next 30 days. A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker…
CVE-2025-14025, published 2026-01-08. High severity, CVSS 8.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows…
CVE-2026-11332, published 2026-06-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument…