Is CVE-2026-84486 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84486 being exploited in the wild.

How severe is CVE-2026-84486?

High severity, with a CVSS score of 8.2, published 23 September 2026.

Is there a fix for CVE-2026-84486?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84486 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84486?

Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84486: Red Hat Ansible Automation Platform debug endpoints authentication bypass

CVE-2026-84486 · Severity: high · CVSS 8.2 · Published 2026-09-23

Red Hat Ansible Automation Platform's automation-controller contains debug endpoints that are accessible without authentication in production builds. An attacker can repeatedly invoke these endpoints to lock the job scheduler, preventing legitimate jobs from running across all tenants and disrupting the entire platform's ability to dispatch work. The vulnerability also exposes sensitive debug information to unauthenticated users.

Technologies: Red Hat Ansible Automation Platform. Vendors: Red Hat.

Quick answers

Is CVE-2026-84486 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84486 being exploited in the wild.
How severe is CVE-2026-84486?: High severity, with a CVSS score of 8.2, published 23 September 2026.
Which products and versions are affected?: Red Hat Ansible Automation Platform <UNKNOWN>.
Is there a fix for CVE-2026-84486?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84486 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84486?: Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in four debug views within automation-controller that trigger internal task, dependency, and workflow schedulers; these views lack proper authentication checks and are routed in production despite being debug-only features. An unauthenticated remote attacker can acquire the cluster-wide scheduler advisory lock through repeated endpoint invocation, causing legitimate scheduler runs to be skipped and exhausting controller web workers. The debug root view additionally leaks the list of debug endpoints to unauthenticated callers.

Affected products

Red Hat Ansible Automation Platform <UNKNOWN>

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.