RHSA-2026:95653: Critical: Satellite 6 Client Update

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is described as authenticated remote code execution, so an attacker needs valid authentication to the affected openvox-agent service before exploiting report event deserialization.

Q: Which systems should be prioritized for triage?

Prioritize Red Hat Satellite Client systems using the affected openvox-agent package, particularly deployments on Red Hat Enterprise Linux for ARM 64, x86_64, or Server Extended Life Cycle Support.

Q: How can I determine whether this advisory applies to a host?

Check whether the host is a Red Hat Satellite Client system and has the openvox-agent package installed. The provided information does not include affected or fixed package versions.

Published Nov 5, 2026

Updated

Critical: Satellite 6 Client Update

Other sources

This advisory provides security fixes for affected packages used by Red HatSatellite Client. The updates address the vulnerability described below.Security Fix(es): openvox-agent: Authenticated remote code execution via report event deserialization (CVE-2026-115731).

— Red Hat

Affected Software

7 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for ARM 64

Red Hat Red Hat Enterprise Linux Server - Extended Life Cycle Support

Red Hat Red Hat Enterprise Linux for x86_64

redhat/openvox-agent<8.32.0-1.el10

8.32.0-1.el10

redhat/openvox-agent<8.32.0-1.el9

8.32.0-1.el9

redhat/openvox-agent<8.32.0-1.el8

8.32.0-1.el8

redhat/openvox-agent<8.32.0-1.el7

8.32.0-1.el7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/openvox-agent to a version that resolves this vulnerability.
Fixed in 8.32.0-1.el10
Upgrade
Upgrade redhat/openvox-agent to a version that resolves this vulnerability.
Fixed in 8.32.0-1.el9
Upgrade
Upgrade redhat/openvox-agent to a version that resolves this vulnerability.
Fixed in 8.32.0-1.el8
Upgrade
Upgrade redhat/openvox-agent to a version that resolves this vulnerability.
Fixed in 8.32.0-1.el7
Operational
Apply all previously released errata relevant to the system before applying the Satellite 6 Client update.

Event History

Nov 5, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·07:36 PM

Data Sourced

via Red Hat·07:36 PM

Severity

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is described as authenticated remote code execution, so an attacker needs valid authentication to the affected openvox-agent service before exploiting report event deserialization.

Which systems should be prioritized for triage?

Prioritize Red Hat Satellite Client systems using the affected openvox-agent package, particularly deployments on Red Hat Enterprise Linux for ARM 64, x86_64, or Server Extended Life Cycle Support.

How can I determine whether this advisory applies to a host?

Check whether the host is a Red Hat Satellite Client system and has the openvox-agent package installed. The provided information does not include affected or fixed package versions.

RHSA-2026:95653: Critical: Satellite 6 Client Update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which systems should be prioritized for triage?

How can I determine whether this advisory applies to a host?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which systems should be prioritized for triage?

How can I determine whether this advisory applies to a host?