Is CVE-2026-28368 being actively exploited?

CVE-2026-28368 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2026-28368?

CVE-2026-28368 has a CVSS 3.1 base score of 8.7 (HIGH).

CVE-2026-28368

HIGH · CVSS 8.7EPSS 0.9%EU EUVD

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

Key facts

CVSS score: 8.7 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-444
EPSS score: 0.9% (58th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2026-16696)
Published: March 27, 2026
NVD last modified: October 14, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2026-16696 in the EU Vulnerability Database. Last updated in EUVD on October 14, 2026.

View on the EU Vulnerability Database

Affected products

redhat / build of apache camel - hawtio
redhat / build of apache camel for spring boot
redhat / data grid
redhat / enterprise linux
redhat / fuse
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform expansion pack
redhat / process automation
redhat / single sign-on
redhat / undertow

Certified products that may be affected

8 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5034 - active
Red Hat Enterprise Linux 9 NSS Cryptographic Module - Red Hat, Inc - FIPS 140 5022 - active
Red Hat Enterprise Linux 9 gnutls - Red Hat, Inc. - FIPS 140 4846 - active

See all 8 in the Security Certifications Explorer.

References

https://access.redhat.com/errata/RHSA-2026:25125
https://access.redhat.com/errata/RHSA-2026:25126
https://access.redhat.com/security/cve/CVE-2026-28368(Vendor Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=2443261(Issue Tracking, Vendor Advisory)

Last updated October 16, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain