VulnSocial

CVE-2026-72526Disclosure

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-441

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-08-17); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-08-12: 1Mentions · 2026-08-17: 2Mentions · 2026-08-20: 1Patch / Workaround · 2026-08-17: 2Technical Details · 2026-08-17: 2Technical Details · 2026-08-20: 108-1208-1708-20
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-08-121
Disclosure1
2026-08-172
Patch2
2026-08-201
Disclosure1
Full discourse4 posts
  • ThreatWire@ThreatWire_
    Patch

    🚨 CRITICAL: Red Hat has patched two CVSS 9.9 remote code execution flaws in Red Hat Advanced Cluster Management (RHACM). Tracked as CVE-2026-72526 and CVE-2026-73268, both vulnerabilities can potentially lead to remote code execution in affected environments. Admins should review Red Hat’s security advisories and apply the available fixes. #RedHat #RHACM #CVE #RCE #CyberSecurity #Kubernetes #CloudSecurity #Infosec

    Post summary

    Red Hat has released patches for two high‑severity remote code execution vulnerabilities (CVE‑2026‑72526 and CVE‑2026‑73268) in RHACM, and admins are advised to apply the fixes.

    2501651.8K
    1.6K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Red Hat fixes RHACM remote code execution flaws, including CVE-2026-72526 and CVE-2026-73268, both CVSS 9.9. See patch and mitigation steps. #RHACM #RedHat #Kubernetes #ArgoCD #RCE #CVE #CyberSecurity #InfoSec https://securityonline.info/rhacm-remote-code-execution-flaws/

    Post summary

    Red Hat has released patches and mitigation steps for RHACM remote code execution flaws CVE‑2026‑72526 and CVE‑2026‑73268 (CVSS 9.9).

    01031451
    13.0K followersView on X
  • セキュリティ対策Lab@securityLab_jp
    Disclosure

    Red Hat RHACM／MCEに深刻な5件の脆弱性　CVSS 9.9、管理クラスタで任意コード実行・権限昇格の恐れ(CVE-2026-72526,CVE-2026-73268)他 https://rocket-boys.co.jp/security-measures-lab/redhat-rhacm-mce-vulnerabilities-cve-2026-72526-73268/ #セキュリティ対策Lab #security #securitynews #セキュリティ #脆弱性

    Post summary

    The article reports five critical vulnerabilities in Red Hat RHACM/MCE (including CVE‑2026‑72526 and CVE‑2026‑73268), noting a CVSS score of 9.9 and the risk of arbitrary code execution and privilege escalation in the management cluster.

    00001179
    550 followersView on X
  • SecNews@SecNews_GR
    Disclosure

    Τα Application resources του Red Hat ACM: Κρίσιμη ευπάθεια CVE-2026-72526 https://secn.ws/cr1FRt

    Post summary

    The post announces a critical vulnerability (CVE‑2026‑72526) affecting Red Hat ACM’s application resources but provides no further technical, exploit, or mitigation details.

    00000154
    7.0K followersView on X

Explore more

Back to dashboard