CVE-2025-10622: the foreman foreman OS Command Injection
Vulnerability summary
CVE-2025-10622 is a high (CVSS 8.0) OS Command Injection vulnerability in the foreman foreman. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 05-11-2025PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · Red hatEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- NVDNIST8.0HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
+0.04 pp
From 0.58% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat14 products
- foreman< 0:3.16.0.4-1.el9sat
- foreman-cli< 0:3.16.0.4-1.el9sat
- foreman-debug< 0:3.16.0.4-1.el9sat
- foreman-dynflow-sidekiq< 0:3.16.0.4-1.el9sat
- foreman-ec2< 0:3.16.0.4-1.el9sat
The foreman1 product
- foreman≥ 3.12.0, < 3.16.1
2 vendors · 15 products
References
295 links- theforeman.org/security.htmlARTICLE
Show all 100 references
Showing 100 of 295. Use Open JSON for the complete list.