Is CVE-2026-16445 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16445 being exploited in the wild.

How severe is CVE-2026-16445?

High severity, with a CVSS score of 7.5, published 21 July 2026.

Is there a fix for CVE-2026-16445?

A patch was published on 2026-06-17: Red Hat released security advisory RHSA-2026:26534 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16445 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-16445?

Check whether you run Red Hat Enterprise Linux 8 or Red Hat OpenShift Container Platform 4. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16445: Red Hat dracut command injection via DHCP options

CVE-2026-16445 · Severity: high · CVSS 7.5 · Published 2026-07-21

A vulnerability in dracut, a tool used to generate the initial boot environment for Linux systems, allows an attacker on the same local network to take full control of a system during its boot process. By sending malicious network configuration data (DHCP options), an attacker can execute commands with root privileges before the operating system has even finished loading. This could lead to complete system compromise, data theft, or persistent backdoors on affected servers and workstations.

Technologies: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4. Vendors: Red Hat.

Quick answers

Is CVE-2026-16445 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16445 being exploited in the wild.
How severe is CVE-2026-16445?: High severity, with a CVSS score of 7.5, published 21 July 2026.
Which products and versions are affected?: Red Hat dracut Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4.
Is there a fix for CVE-2026-16445?: A patch was published on 2026-06-17: Red Hat released security advisory RHSA-2026:26534 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16445 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-16445?: Check whether you run Red Hat Enterprise Linux 8 or Red Hat OpenShift Container Platform 4. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in dracut's NetworkManager-based and legacy dhclient-script.sh initrd network modules. The flaw is caused by improper neutralization of special elements in DHCP-provided values (such as root-path, next-server, or host-name) before they are written into temporary shell scripts. These scripts are subsequently sourced as root during the initramfs stage of the boot process. An attacker on the adjacent network (Layer 2) can provide specially crafted DHCP options containing shell metacharacters to achieve arbitrary code execution with root privileges within the initramfs. Red Hat has released patches for affected versions of RHEL 8 and OpenShift.

Affected products

Red Hat dracut Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4

Timeline

2026-04-21: disclosed: Initial report to Red Hat maintainers
2026-06-17: patched: Red Hat released security advisory RHSA-2026:26534
2026-07-21: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.