Security readout for executives and security teams
Plain-English summary
CVE-2026-0980 is a high-severity command injection issue in rubyipmi used by Red Hat Satellite’s BMC functionality. A logged-in user with host creation or update rights could supply a malicious BMC username and cause code execution on the Satellite system. This is most urgent where many users can manage hosts.
Executive priority
Prioritize remediation in the next maintenance window, sooner for shared administration environments or exposed management interfaces. This is not currently cited as exploited, but it enables code execution by a lower-privileged authenticated user, making privilege governance and timely patching important.
Technical view
Red Hat describes CWE-78 remote code execution via the BMC username field in rubyipmi. The CVSS 3.1 score is 8.3, with network attack vector, low complexity, low privileges, and no user interaction. Listed affected areas include Red Hat Satellite 6.16 on RHEL 8/9 and Satellite 6.17 on RHEL 9 components.
Likely exposure
Exposure is likely limited to Red Hat Satellite environments using affected 6.16 or 6.17 packages and allowing authenticated users to create or update hosts with BMC settings. Internet exposure of Satellite management interfaces would increase operational risk, but authentication and specific permissions are required.
Exploitation context
The source bundle does not indicate known active exploitation, and KEV status is false. The attacker must already authenticate and hold host creation or update permissions. Successful exploitation could compromise confidentiality and integrity of the Satellite system, with limited availability impact per CVSS.
Researcher notes
The affected-package list includes rubyipmi for Satellite 6.16 and multiple Satellite 6.17 packages, including rubygem-rubyipmi. Public details identify the vulnerable input as the BMC username but do not provide safe verification specifics. Use Red Hat’s CVE page, Bugzilla, and errata for authoritative package and fix status.
Mitigation direction
- Review Red Hat advisories RHSA-2026:5968, RHSA-2026:5970, and RHSA-2026:5971.
- Apply the vendor-provided Red Hat Satellite updates applicable to your version and platform.
- Restrict host creation and update permissions to trusted administrators.
- Limit network access to Red Hat Satellite management interfaces.
- Audit accounts with BMC or host provisioning privileges.
Validation and detection
- Inventory Red Hat Satellite 6.16 and 6.17 deployments.
- Check installed versions of rubygem-rubyipmi and listed Satellite component packages.
- Confirm whether applicable Red Hat errata have been applied.
- Review user roles for host create or update permissions.
- Check Satellite logs for unusual BMC username changes or host update activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-0980 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L2.85.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.3HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:5968CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:5970CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:5971CVE reference · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-0980CVE reference · vdb-entry, x_refsource_REDHAT
- RHBZ#2429874CVE reference · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.