Is CVE-2026-39364 in the CISA KEV catalog?

No. CVE-2026-39364 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2026-39364?

CVE-2026-39364 has a CVSS v3 base score of 7.5 (HIGH).

What is the EPSS score for CVE-2026-39364?

CVE-2026-39364 has an EPSS score of 2.10% (80th percentile), estimating the probability of exploitation in the next 30 days.

CVE & CISA-KEV Catalog

CVE-2026-39364

Q: How do I fix CVE-2026-39364?

Upgrade registry.redhat.io/ansible-automation-platform on rocky 8 to 26/controller-rhel9@sha256:b37af6bef902e0eb955654296154355ed9941569929d2db7a22a595b0fa0162c_amd64 or later. Fixes are available for 36 affected products.

HIGHEPSS 80th pctl

7.5

CVSS v3

NVD

Description

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.

CWE-180 CWE-284Improper Access Control CWE-472

How to fix

Remediation Available

registry.redhat.io/ansible-automation-platformRocky

Fixed in:26/controller-rhel9@sha256:b37af6bef902e0eb955654296154355ed9941569929d2db7a22a595b0fa0162c_amd64RHSA-2026:24866

Fixed in:26/gateway-rhel9@sha256:baf3be5dd66c26b9295da4d9202e93fa1c718b5ac0700bb450acccbd57367082_s390xRHSA-2026:24866

Fixed in:26/hub-rhel9@sha256:fc3ff82f0cf98d1e8031a0a53c4fc06d4783b668b8d22229fd0a13d74b3e3d84_s390xRHSA-2026:24866

Fixed in:26/receptor-rhel9@sha256:21176a1983a9b934e8b8ad5ff1db86540883bb160e15a733b7ef4f6c11974da9_ppc64leRHSA-2026:24866

Fixed in:26/receptor-rhel9@sha256:abad27dec9638ed160bce90a10facb04fdce91bcb2969470ffc8c436ac01de50_amd64RHSA-2026:24866

Fixed in:26/lightspeed-rhel9@sha256:94b9b25cba1fd560c6572ebde1cce9ea9c959ce31d2f02561e68ff7db580bdcf_s390xRHSA-2026:24866

Fixed in:26/hub-rhel9@sha256:878088c9089f2d9b9eda19edb88c6f11b65316dcdd0291049e357d7d6f5ba9b2_amd64RHSA-2026:24866

Fixed in:26/gateway-rhel9@sha256:78cf27a0aa87e23ead38510b5f76b56053fd2fb19dd8dffef714106b035e66cc_amd64RHSA-2026:24866

Fixed in:26/lightspeed-rhel9@sha256:87b7771c1db5e931baf83d00528dc7b65e90c8828032741a5a1c37cbc4a300b8_amd64RHSA-2026:24866

Fixed in:26/controller-rhel9@sha256:dfc798d88444141412d07492a1f426f083c6b7e3499db2f78abfeba0123c5821_s390xRHSA-2026:24866

Fixed in:26/gateway-rhel9@sha256:503dfe60277d2a1b378eec07e179928add2af1d968614f46756a47df11a58579_ppc64leRHSA-2026:24866

Fixed in:26/receptor-rhel9@sha256:ca3c0b4e72dc9df0eb2626898a3b731b31c2503b9dc907a060defb902c708bf4_arm64RHSA-2026:24866

Fixed in:26/hub-rhel9@sha256:4e335af8d2fc8b8df96c1338a17fe2e32c51bd16229008ec66d40cc24187a8c6_arm64RHSA-2026:24866

Fixed in:26/gateway-rhel9@sha256:085f4b5bef40a152a53dab4032b8f86d00f19186e0e8cc44c43654172c7247e0_arm64RHSA-2026:24866

Fixed in:26/controller-rhel9@sha256:c076cf5c0e56918bb49e8c353bc48265a9d88834934563259308cad15eb304e2_ppc64leRHSA-2026:24866

Fixed in:26/hub-rhel9@sha256:12e4d0feaa59c71d5e846dce888e17467a6922aa08a9c2971ae15a47604c8cc2_ppc64leRHSA-2026:24866

Fixed in:26/controller-rhel9@sha256:77ab5de9e627656bd9668724e2f59a37510a4905801edd183ecf380dcd9fe585_arm64RHSA-2026:24866

Fixed in:26/lightspeed-rhel9@sha256:6e5abb4c408bdb38987e13f09d6a1699de40ef39243ac91a5731c48b377169b0_arm64RHSA-2026:24866

Fixed in:26/receptor-rhel9@sha256:e2abe7d7c1a00c6b7911e6db28924f50640abfd88a99ade0690f5394a42e4fdc_s390xRHSA-2026:24866

Fixed in:26/lightspeed-rhel9@sha256:5a18e28d9adc93f7429ee2aeddfed16beabb8ea777b568576f35c85579902a81_ppc64leRHSA-2026:24866

registry.redhat.io/ansible-automation-platformRed Hat / RHEL