Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-18963 (GCVE-0-2026-18963)
Vulnerability from cvelistv5 – Published: 2026-08-18 17:05 – Updated: 2026-09-08 08:44Title
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
Summary
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:53 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:56519 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:56520 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:56523 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:56524 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-18963 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2511595 | issue-trackingx_refsource_REDHAT |
| https://cert-portal.siemens.com/productcert/html/… |
Impacted products
12 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 |
Unaffected:
26.4.15-1 , < *
(rpm)
cpe:/a:redhat:build_keycloak:26.4::el9 |
||
| Red Hat | Red Hat build of Keycloak 26.4 |
Unaffected:
26.4-23 , < *
(rpm)
cpe:/a:redhat:build_keycloak:26.4::el9 |
||
| Red Hat | Red Hat build of Keycloak 26.4.15 |
cpe:/a:redhat:build_keycloak:26.4
|
||
| Red Hat | Red Hat build of Keycloak 26.6 |
Unaffected:
26.6.6-1 , < *
(rpm)
cpe:/a:redhat:build_keycloak:26.6::el9 |
||
| Red Hat | Red Hat build of Keycloak 26.6 |
Unaffected:
26.6-12 , < *
(rpm)
cpe:/a:redhat:build_keycloak:26.6::el9 |
||
| Red Hat | Red Hat build of Keycloak 26.6.6 |
cpe:/a:redhat:build_keycloak:26.6
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
||
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
||
| Siemens | Industrial Edge Management Cloud |
Affected:
0 , < *
(custom)
|
guessed | |
| Siemens | Industrial Edge Management Pro V1 |
Affected:
V1.14.9 , < V1.15.20
(custom)
|
guessed | |
| Siemens | Industrial Edge Management Pro V2 |
Affected:
V2.2.0 , < V2.2.2
(custom)
|
guessed | |
| Siemens | Industrial Edge Management Virtual |
Affected:
V2.6.0 , < V2.9.1
(custom)
|
guessed |
Date Public
2026-08-17 00:00
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: ac24fb5c-fbc7-4c87-9137-bb60608b01e0
Exploited: Yes
Timestamps
First Seen: 2026-08-25
Asserted: 2026-08-25
Scope
Notes: Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass | Affected: Red Hat / Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.15, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.6, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7 | CVSS: 9.1 (CRITICAL) | EPSS: 0.02788 | Used in malware: unknown | Not yet in CISA KEV: True
Evidence
Type: Public Report
Signal: Successful Exploitation
Confidence: 70%
Source: previdian
Details
| Feed | Previdian (previdian.com) |
|---|---|
| Title | Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass |
| Vendor | Red Hat |
| Product | Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.15, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.6, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7 |
| Added Date | 2026-08-25T15:13:17.550Z |
| Cvss Score | 9.1 |
| Epss Score | 0.02788 |
| Cvss Severity | CRITICAL |
| Epss Percentile | 0.85319 |
| Used In Malware | unknown |
| Ahead Of Cisa Kev | None |
| Not Yet In Cisa Kev | True |
References
Created: 2026-08-26 16:00 UTC
| Updated: 2026-08-26 16:00 UTC
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18963",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:53:38.227092Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T13:53:45.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "Industrial Edge Management Cloud",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Industrial Edge Management Pro V1",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V1.15.20",
"status": "affected",
"version": "V1.14.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Industrial Edge Management Pro V2",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V2.2.2",
"status": "affected",
"version": "V2.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Industrial Edge Management Virtual",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V2.9.1",
"status": "affected",
"version": "V2.6.0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:44:23.776Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-503852.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-operator-bundle",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4.15-1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4-23",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4-23",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat build of Keycloak 26.4.15",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4"
],
"defaultStatus": "unaffected",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"product": "Red Hat build of Keycloak 26.4.15",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-operator-bundle",
"product": "Red Hat build of Keycloak 26.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.6.6-1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.6-12",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat build of Keycloak 26.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.6-12",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat build of Keycloak 26.6.6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6"
],
"defaultStatus": "unaffected",
"packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.6.6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6"
],
"defaultStatus": "unaffected",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"product": "Red Hat build of Keycloak 26.6.6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank James Paremain for reporting this issue."
}
],
"datePublic": "2026-08-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Critical"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T22:25:58.686Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:56519",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56519"
},
{
"name": "RHSA-2026:56520",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56520"
},
{
"name": "RHSA-2026:56523",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
},
{
"name": "RHSA-2026:56524",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-18963"
},
{
"name": "RHBZ#2511595",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-31T15:46:15.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-08-17T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass",
"workarounds": [
{
"lang": "en",
"value": "If an immediate upgrade is not possible, disabling the \"Forgot password\" functionality across all realms can be used as a temporary mitigation.\n\nIn the RHBK administration console, navigate to:\n\nRealm settings \u2192 Login \u2192 Forgot password \u2192 Off\n\nApply this setting to all realms.\n\nUpgrade to a fixed version as soon as possible."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-18963",
"datePublished": "2026-08-18T17:05:07.478Z",
"dateReserved": "2026-08-05T15:00:40.360Z",
"dateUpdated": "2026-09-08T08:44:23.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-18963",
"date": "2026-09-08",
"epss": "0.03177",
"percentile": "0.87211"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-18963\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-08-18T17:16:57.083\",\"lastModified\":\"2026-09-08T09:17:43.063\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.4::el9\"],\"versions\":[{\"version\":\"26.4.15-1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.4::el9\"],\"versions\":[{\"version\":\"26.4-23\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.4::el9\"],\"versions\":[{\"version\":\"26.4-23\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.4.15\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"keycloak-services\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.4.15\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-openshift-rhel9/rhbk-openshift-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"26.6.6-1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"26.6-12\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"26.6-12\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"keycloak-services\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-keycloak-rhel9/rhbk-keycloak-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-openshift-rhel9/rhbk-openshift-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\"packageName\":\"keycloak-services\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"keycloak-services\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"Industrial Edge Management Cloud\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Industrial Edge Management Pro V1\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V1.14.9\",\"lessThan\":\"V1.15.20\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Industrial Edge Management Pro V2\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V2.2.0\",\"lessThan\":\"V2.2.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Industrial Edge Management Virtual\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V2.6.0\",\"lessThan\":\"V2.9.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-20T13:53:38.227092Z\",\"id\":\"CVE-2026-18963\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-640\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:56519\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:56520\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:56523\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:56524\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-18963\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2511595\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-503852.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
"redhat_vex": {
"aggregate_severity": "Critical",
"current_release_date": "2026-08-20T22:25:54+00:00",
"cve": "CVE-2026-18963",
"id": "CVE-2026-18963",
"initial_release_date": "2026-08-17T00:00:00+00:00",
"product_status:fixed": "20",
"product_status:known_not_affected": "2",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18963.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-18963\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-20T13:53:38.227092Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-20T13:53:42.089Z\"}}], \"cna\": {\"title\": \"Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank James Paremain for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Critical\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.4.15-1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-operator-bundle\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.4-23\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.4-23\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.4.15\", \"packageName\": \"keycloak-services\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.4.15\", \"packageName\": \"rhbk-openshift-rhel9/rhbk-openshift-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.6.6-1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-operator-bundle\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.6-12\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.6-12\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.6\", \"packageName\": \"keycloak-services\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.6\", \"packageName\": \"rhbk-keycloak-rhel9/rhbk-keycloak-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.6\", \"packageName\": \"rhbk-openshift-rhel9/rhbk-openshift-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"keycloak-services\", \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"keycloak-services\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-07-31T15:46:15.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-08-17T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-08-17T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:56519\", \"name\": \"RHSA-2026:56519\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:56520\", \"name\": \"RHSA-2026:56520\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:56523\", \"name\": \"RHSA-2026:56523\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:56524\", \"name\": \"RHSA-2026:56524\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-18963\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2511595\", \"name\": \"RHBZ#2511595\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"If an immediate upgrade is not possible, disabling the \\\"Forgot password\\\" functionality across all realms can be used as a temporary mitigation.\\n\\nIn the RHBK administration console, navigate to:\\n\\nRealm settings \\u2192 Login \\u2192 Forgot password \\u2192 Off\\n\\nApply this setting to all realms.\\n\\nUpgrade to a fixed version as soon as possible.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-640\", \"description\": \"Weak Password Recovery Mechanism for Forgotten Password\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-08-20T22:25:58.686Z\"}, \"x_redhatCweChain\": \"CWE-640: Weak Password Recovery Mechanism for Forgotten Password\"}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-18963\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-20T22:25:58.686Z\", \"dateReserved\": \"2026-08-05T15:00:40.360Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-08-18T17:05:07.478Z\", \"assignerShortName\": \"redhat\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
bit-keycloak-2026-18963
Vulnerability from bitnami_vulndb
Published
2026-08-25 10:46
Modified
2026-08-25 10:46
Summary
Flaw in the reset-credentials flow of the keycloak-services component
Details
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
{
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "keycloak",
"purl": "pkg:bitnami/keycloak"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.7.2"
}
],
"type": "SEMVER"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
],
"aliases": [
"CVE-2026-18963"
],
"database_specific": {
"cpes": [
"cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*",
"cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*"
],
"severity": "Critical"
},
"details": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
"id": "BIT-keycloak-2026-18963",
"modified": "2026-08-25T10:46:44.542Z",
"published": "2026-08-25T10:46:44.542Z",
"references": [
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-18963"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56519"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56520"
}
],
"schema_version": "1.6.2",
"summary": "Flaw in the reset-credentials flow of the keycloak-services component"
}
CERTFR-2026-AVI-1078
Vulnerability from certfr_avis - Published: 2026-08-25 - Updated: 2026-08-25
De multiples vulnérabilités ont été découvertes dans Keycloak. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.
Le CERT-FR a connaissance d'une preuve de concept publique pour la vulnérabilité CVE-2026-18963 qui permet à un attaquant non authentifié de prendre le contrôle d'un compte dont il connait l'identifiant.
Mesure de contournement
Si l'application de la mise à jour n'est pas possible, l'équipe de sécurité de Red Hat recommande de désactiver la fonctionnalité "Forgot password" pour tous les domaines d'authentification (cf. section Documentation). Celle-ci n'est pas activée par défaut.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Keycloak versions ant\u00e9rieures \u00e0 26.7.2",
"product": {
"name": "Keycloak",
"vendor": {
"name": "Keycloak",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-15945",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15945"
},
{
"name": "CVE-2026-45292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45292"
},
{
"name": "CVE-2026-15571",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15571"
},
{
"name": "CVE-2026-17048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-17048"
},
{
"name": "CVE-2026-59888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59888"
},
{
"name": "CVE-2026-18963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18963"
},
{
"name": "CVE-2026-14613",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14613"
},
{
"name": "CVE-2026-59889",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59889"
}
],
"initial_release_date": "2026-08-25T00:00:00",
"last_revision_date": "2026-08-25T00:00:00",
"links": [
{
"title": "Article Red Hat sur la vuln\u00e9rabilit\u00e9 CVE-2026-18963",
"url": "https://access.redhat.com/security/cve/cve-2026-18963"
}
],
"reference": "CERTFR-2026-AVI-1078",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-25T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Keycloak. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9 et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.\n\nLe CERT-FR a connaissance d\u0027une preuve de concept publique pour la vuln\u00e9rabilit\u00e9 CVE-2026-18963 qui permet \u00e0 un attaquant non authentifi\u00e9 de prendre le contr\u00f4le d\u0027un compte dont il connait l\u0027identifiant.\n\n## Mesure de contournement\n\nSi l\u0027application de la mise \u00e0 jour n\u0027est pas possible, l\u0027\u00e9quipe de s\u00e9curit\u00e9 de Red Hat recommande de d\u00e9sactiver la fonctionnalit\u00e9 \"Forgot password\" pour tous les domaines d\u0027authentification (cf. section Documentation). Celle-ci n\u0027est pas activ\u00e9e par d\u00e9faut.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Keycloak",
"vendor_advisories": [
{
"published_at": "2026-08-19",
"title": "Bulletin de s\u00e9curit\u00e9 Keycloack",
"url": "https://www.keycloak.org/2026/08/keycloak-2672-released"
}
]
}
FKIE_CVE-2026-18963
Vulnerability from fkie_nvd - Published: 2026-08-18 17:16 - Updated: 2026-09-08 09:17
Severity
Summary
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-operator-bundle",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4.15-1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4-23",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat build of Keycloak 26.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.4-23",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat build of Keycloak 26.4.15",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4"
],
"defaultStatus": "unaffected",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"product": "Red Hat build of Keycloak 26.4.15",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-operator-bundle",
"product": "Red Hat build of Keycloak 26.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.6.6-1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.6-12",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat build of Keycloak 26.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "26.6-12",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat build of Keycloak 26.6.6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6"
],
"defaultStatus": "unaffected",
"packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
"product": "Red Hat build of Keycloak 26.6.6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6"
],
"defaultStatus": "unaffected",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"product": "Red Hat build of Keycloak 26.6.6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"source": "secalert@redhat.com"
},
{
"affectedData": [
{
"defaultStatus": "unknown",
"product": "Industrial Edge Management Cloud",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Industrial Edge Management Pro V1",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V1.15.20",
"status": "affected",
"version": "V1.14.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Industrial Edge Management Pro V2",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V2.2.2",
"status": "affected",
"version": "V2.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Industrial Edge Management Virtual",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V2.9.1",
"status": "affected",
"version": "V2.6.0",
"versionType": "custom"
}
]
}
],
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials."
}
],
"id": "CVE-2026-18963",
"lastModified": "2026-09-08T09:17:43.063",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "secalert@redhat.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-18963",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:53:38.227092Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-18T17:16:57.083",
"references": [
{
"source": "secalert@redhat.com",
"url": "https://access.redhat.com/errata/RHSA-2026:56519"
},
{
"source": "secalert@redhat.com",
"url": "https://access.redhat.com/errata/RHSA-2026:56520"
},
{
"source": "secalert@redhat.com",
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
},
{
"source": "secalert@redhat.com",
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
},
{
"source": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2026-18963"
},
{
"source": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-503852.html"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-640"
}
],
"source": "secalert@redhat.com",
"type": "Secondary"
}
]
}
GHSA-4GV3-MC9P-5WQC
Vulnerability from github – Published: 2026-08-18 18:32 – Updated: 2026-08-28 22:53
VLAI
Summary
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
Details
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Severity
9.1 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "26.0.0"
},
{
"fixed": "26.4.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "26.5.0"
},
{
"fixed": "26.6.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "26.7.0"
},
{
"fixed": "26.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-18963"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T22:53:41Z",
"nvd_published_at": "2026-08-18T17:16:57Z",
"severity": "CRITICAL"
},
"details": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
"id": "GHSA-4gv3-mc9p-5wqc",
"modified": "2026-08-28T22:53:41Z",
"published": "2026-08-18T18:32:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/51833"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/pull/51844"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/dc2d4e524b4dae85aedc87ca28b9e4fa567d56c1"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56519"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56520"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-18963"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak: Unauthenticated account takeover via reset-credentials flow bypass"
}
NCSC-2026-0326
Vulnerability from csaf_ncscnl - Published: 2026-08-25 13:39 - Updated: 2026-08-25 13:39Summary
Kwetsbaarheden verholpen in Keycloak
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Red Hat heeft meerdere kwetsbaarheden verholpen in Keycloak.
Interpretaties: De kwetsbaarheid met CVE-2026-18963 kan een ongeauthenticeerde externe aanvaller in staat stellen om elke gebruikersaccount over te nemen door een wachtwoordreset af te dwingen. Door deze kwetsbaarheid valt het e-mailverificatieproces bij wachtwoordreset te omzeilen en wachtwoorden van gebruikers te wijzigen.
In Keycloak zijn daarnaast kwetsbaarheden aanwezig in de Fine-Grained Admin Permissions (FGAP) v2, waardoor bepaalde beheerders met beperkte permissies metadata van verborgen groepen kunnen inzien en details van ongeautoriseerde oudergroepen kunnen blootstellen. Verder kunnen geauthenticeerde aanvallers via een legacy client-initiated account-linking endpoint CSRF-bescherming omzeilen en accounts overnemen. Ook kunnen gedelegeerde beheerders met alleen leesrechten client secrets uitlezen door een fout in de secret rotation. Voor OpenTelemetry Java was er een kwetsbaarheid waarbij het ontbreken van limieten op baggage headers leidde tot onbegrensd geheugen- en CPU-gebruik, wat Denial-of-Service kan veroorzaken. Bij Jackson-libraries is een bypass van de @JsonIgnore annotatie in Java Records vastgesteld, waardoor ongewenste toewijzing aan constructorparameters mogelijk is. Ook zijn er bypasses van @JsonIgnoreProperties, ontbrekende view guards op @JsonUnwrapped en ongeautoriseerde schrijfacties op velden met @JsonView. Oracle Database Server's Fleet Patching and Provisioning component is eveneens getroffen door een kwetsbaarheid die ongeautoriseerde data toegang of Denial-of-Service kan veroorzaken.
Oplossingen: Red Hat heeft updates uitgebracht om deze kwetsbaarheden in Keycloak te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-341: Predictable from Observable State
CWE-502: Deserialization of Untrusted Data
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-863: Incorrect Authorization
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
A Moderate severity vulnerability in Keycloak's admin interface with FGAP v2 enabled allows certain administrators to view metadata of hidden groups due to missing permission checks on role-to-group mappings in the RoleContainerResource component.
4.3 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Keycloak / keycloak
|
vers:unknown/* | ||
|
vers:unknown/*
Red Hat / Build of Keycloak
|
vers:unknown/* |
A critical vulnerability in Keycloak's legacy client-initiated account-linking endpoint allows attackers to predict security hashes and forge linking URLs, enabling unauthorized account linking and full account takeover.
7.3 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Keycloak / keycloak
|
vers:unknown/* | ||
|
vers:unknown/*
Red Hat / Build of Keycloak
|
vers:unknown/* |
A vulnerability in Keycloak's administrative API group search under FGAP v2 allows delegated administrators to bypass access controls and view unauthorized parent group details by exploiting improper filtering during hierarchical group searches.
4.3 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Keycloak / keycloak
|
vers:unknown/* | ||
|
vers:unknown/*
Red Hat / Build of Keycloak
|
vers:unknown/* |
A vulnerability in the Keycloak Admin REST API allows delegated administrators with view-only permissions to access client secrets due to improper boundary enforcement during secret rotation.
5.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Keycloak / keycloak
|
vers:unknown/* | ||
|
vers:unknown/*
Red Hat / Build of Keycloak
|
vers:unknown/* |
A critical vulnerability in Keycloak versions before 26.7.2, 26.6.6, and 26.4.15 allows unauthenticated attackers to bypass email verification in the reset-credentials flow, enabling full account takeover via improper state validation.
9.1 (Critical)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Keycloak / keycloak
|
vers:unknown/* | ||
|
vers:unknown/*
Red Hat / Build of Keycloak
|
vers:unknown/* |
OpenTelemetry Java versions prior to 1.62.0 contained a vulnerability in baggage propagation that allowed unbounded memory and CPU consumption via oversized baggage headers, potentially impacting downstream services, fixed by enforcing W3C size limits in 1.62.0.
7.5 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Keycloak / keycloak
|
vers:unknown/* | ||
|
vers:unknown/*
Red Hat / Build of Keycloak
|
vers:unknown/* |
Jackson-databind versions 2.15.0 to 2.18.8, 2.21.4, and 3.1.4 had vulnerabilities allowing bypass of @JsonIgnore and @JsonIgnoreProperties on Java Records with PropertyNamingStrategy, fixed in versions 2.18.8, 2.21.4, 3.1.4, and 2.18.9.
6.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Keycloak / keycloak
|
vers:unknown/* | ||
|
vers:unknown/*
Red Hat / Build of Keycloak
|
vers:unknown/* |
Multiple vulnerabilities in Jackson components, including jackson-databind versions 2.18.0 to 2.18.9 and others, allow bypass of @JsonView and @JsonIgnoreProperties restrictions, enabling unauthorized JSON property writes and privilege escalation.
8.1 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Keycloak / keycloak
|
vers:unknown/* | ||
|
vers:unknown/*
Red Hat / Build of Keycloak
|
vers:unknown/* |
References
13 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Red Hat heeft meerdere kwetsbaarheden verholpen in Keycloak.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheid met CVE-2026-18963 kan een ongeauthenticeerde externe aanvaller in staat stellen om elke gebruikersaccount over te nemen door een wachtwoordreset af te dwingen. Door deze kwetsbaarheid valt het e-mailverificatieproces bij wachtwoordreset te omzeilen en wachtwoorden van gebruikers te wijzigen.\n\nIn Keycloak zijn daarnaast kwetsbaarheden aanwezig in de Fine-Grained Admin Permissions (FGAP) v2, waardoor bepaalde beheerders met beperkte permissies metadata van verborgen groepen kunnen inzien en details van ongeautoriseerde oudergroepen kunnen blootstellen. Verder kunnen geauthenticeerde aanvallers via een legacy client-initiated account-linking endpoint CSRF-bescherming omzeilen en accounts overnemen. Ook kunnen gedelegeerde beheerders met alleen leesrechten client secrets uitlezen door een fout in de secret rotation. Voor OpenTelemetry Java was er een kwetsbaarheid waarbij het ontbreken van limieten op baggage headers leidde tot onbegrensd geheugen- en CPU-gebruik, wat Denial-of-Service kan veroorzaken. Bij Jackson-libraries is een bypass van de @JsonIgnore annotatie in Java Records vastgesteld, waardoor ongewenste toewijzing aan constructorparameters mogelijk is. Ook zijn er bypasses van @JsonIgnoreProperties, ontbrekende view guards op @JsonUnwrapped en ongeautoriseerde schrijfacties op velden met @JsonView. Oracle Database Server\u0027s Fleet Patching and Provisioning component is eveneens getroffen door een kwetsbaarheid die ongeautoriseerde data toegang of Denial-of-Service kan veroorzaken.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Red Hat heeft updates uitgebracht om deze kwetsbaarheden in Keycloak te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Predictable from Observable State",
"title": "CWE-341"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Authorization Bypass Through User-Controlled Key",
"title": "CWE-639"
},
{
"category": "general",
"text": "Weak Password Recovery Mechanism for Forgotten Password",
"title": "CWE-640"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "general",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://access.redhat.com/errata/RHSA-2026:56519"
},
{
"category": "external",
"summary": "Reference",
"url": "https://access.redhat.com/errata/RHSA-2026:56520"
},
{
"category": "external",
"summary": "Reference",
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
},
{
"category": "external",
"summary": "Reference",
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
},
{
"category": "external",
"summary": "Reference",
"url": "https://www.keycloak.org/2026/08/keycloak-2672-released"
}
],
"title": "Kwetsbaarheden verholpen in Keycloak",
"tracking": {
"current_release_date": "2026-08-25T13:39:25.285061Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0326",
"initial_release_date": "2026-08-25T13:39:25.285061Z",
"revision_history": [
{
"date": "2026-08-25T13:39:25.285061Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "keycloak"
}
],
"category": "vendor",
"name": "Keycloak"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Build of Keycloak"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-14613",
"notes": [
{
"category": "description",
"text": "A Moderate severity vulnerability in Keycloak\u0027s admin interface with FGAP v2 enabled allows certain administrators to view metadata of hidden groups due to missing permission checks on role-to-group mappings in the RoleContainerResource component.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-14613 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-14613.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-14613"
},
{
"cve": "CVE-2026-15571",
"cwe": {
"id": "CWE-341",
"name": "Predictable from Observable State"
},
"notes": [
{
"category": "other",
"text": "Predictable from Observable State",
"title": "CWE-341"
},
{
"category": "description",
"text": "A critical vulnerability in Keycloak\u0027s legacy client-initiated account-linking endpoint allows attackers to predict security hashes and forge linking URLs, enabling unauthorized account linking and full account takeover.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-15571 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15571.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-15571"
},
{
"cve": "CVE-2026-15945",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"notes": [
{
"category": "other",
"text": "Authorization Bypass Through User-Controlled Key",
"title": "CWE-639"
},
{
"category": "description",
"text": "A vulnerability in Keycloak\u0027s administrative API group search under FGAP v2 allows delegated administrators to bypass access controls and view unauthorized parent group details by exploiting improper filtering during hierarchical group searches.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-15945 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15945.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-15945"
},
{
"cve": "CVE-2026-17048",
"notes": [
{
"category": "description",
"text": "A vulnerability in the Keycloak Admin REST API allows delegated administrators with view-only permissions to access client secrets due to improper boundary enforcement during secret rotation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-17048 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17048.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-17048"
},
{
"cve": "CVE-2026-18963",
"cwe": {
"id": "CWE-640",
"name": "Weak Password Recovery Mechanism for Forgotten Password"
},
"notes": [
{
"category": "other",
"text": "Weak Password Recovery Mechanism for Forgotten Password",
"title": "CWE-640"
},
{
"category": "description",
"text": "A critical vulnerability in Keycloak versions before 26.7.2, 26.6.6, and 26.4.15 allows unauthenticated attackers to bypass email verification in the reset-credentials flow, enabling full account takeover via improper state validation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-18963 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18963.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-18963"
},
{
"cve": "CVE-2026-45292",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "OpenTelemetry Java versions prior to 1.62.0 contained a vulnerability in baggage propagation that allowed unbounded memory and CPU consumption via oversized baggage headers, potentially impacting downstream services, fixed by enforcing W3C size limits in 1.62.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-45292 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45292.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-45292"
},
{
"cve": "CVE-2026-59888",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
},
{
"category": "description",
"text": "Jackson-databind versions 2.15.0 to 2.18.8, 2.21.4, and 3.1.4 had vulnerabilities allowing bypass of @JsonIgnore and @JsonIgnoreProperties on Java Records with PropertyNamingStrategy, fixed in versions 2.18.8, 2.21.4, 3.1.4, and 2.18.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59888 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59888.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-59888"
},
{
"cve": "CVE-2026-59889",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "description",
"text": "Multiple vulnerabilities in Jackson components, including jackson-databind versions 2.18.0 to 2.18.9 and others, allow bypass of @JsonView and @JsonIgnoreProperties restrictions, enabling unauthorized JSON property writes and privilege escalation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59889 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59889.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-59889"
}
]
}
NCSC-2026-0346
Vulnerability from csaf_ncscnl - Published: 2026-09-08 13:46 - Updated: 2026-09-08 13:49Summary
Kwetsbaarheden verholpen in Siemens producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Siemens heeft kwetsbaarheden verholpen in diverse producten als Desigo, Reyrolle, SIMATIC, SCALANCE, SINAMICS en Siveillance.
Interpretaties: De kwetsbaarheden stellen een kwaadwillende in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
* Denial-of-Service (DoS)
* Manipulatie van gegevens
* Omzeilen van een beveiligingsmaatregel
* (Remote) code execution (root/admin rechten)
* (Remote) code execution (gebruikersrechten)
* Toegang tot gevoelige gegevens
* Verhogen van rechten
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
Oplossingen: De betrokken leveranciers hebben updates uitgebracht om de genoemde kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23: Relative Path Traversal
CWE-35: Path Traversal: '.../...//'
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-121: Stack-based Buffer Overflow
CWE-125: Out-of-bounds Read
CWE-140: Improper Neutralization of Delimiters
CWE-190: Integer Overflow or Wraparound
CWE-215: Insertion of Sensitive Information Into Debugging Code
CWE-272: Least Privilege Violation
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-306: Missing Authentication for Critical Function
CWE-319: Cleartext Transmission of Sensitive Information
CWE-331: Insufficient Entropy
CWE-427: Uncontrolled Search Path Element
CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-457: Use of Uninitialized Variable
CWE-476: NULL Pointer Dereference
CWE-489: Active Debug Code
CWE-494: Download of Code Without Integrity Check
CWE-620: Unverified Password Change
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
CWE-669: Incorrect Resource Transfer Between Spheres
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-787: Out-of-bounds Write
CWE-823: Use of Out-of-range Pointer Offset
CWE-1188: Initialization of a Resource with an Insecure Default
CWE-1288: Improper Validation of Consistency within Input
Cesanta Mongoose Web Server v7.14 contains an Integer Overflow vulnerability that can be exploited by sending malformed TLS packets, resulting in a segmentation fault and application crash.
7.5 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Cesanta Mongoose Web Server v7.14 contains an Improper Neutralization of Delimiters vulnerability that can lead to out-of-bound memory writes when processing PEM certificates with unexpected characters.
4.0 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in Cesanta Mongoose Web Server v7.14 allows attackers to trigger a segmentation fault by sending a malformed TLS packet that causes an out-of-range pointer offset.
8.2 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in Cesanta Mongoose Web Server v7.14 allows attackers to send crafted TLS packets that trigger out-of-range pointer offsets, causing the application to read unintended heap memory.
4.3 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Cesanta Mongoose Web Server v7.14 contains an Improper Neutralization of Delimiters vulnerability that can trigger an infinite loop when processing input strings with unexpected characters.
4.0 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Multiple SIMATIC devices with certain versions have insufficient protection of EFI variables, allowing an authenticated attacker to alter secure boot configuration via direct communication with the flash controller.
8.2 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Multiple SIMATIC device models with certain versions have a vulnerability due to insufficient EFI variable protection, allowing an authenticated attacker to disable the BIOS password via direct flash controller communication.
8.2 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
OpenSSL 3.x contains a stack buffer overflow vulnerability in CMS AuthEnvelopedData parsing with oversized IVs in AEAD ciphers that can cause crashes or remote code execution, affecting multiple products including Red Hat and NetApp, while versions 1.1.1 and 1.0.2 remain unaffected.
9.8 (Critical)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A setup component is vulnerable to DLL hijacking, enabling attackers to execute arbitrary code during legitimate application installations.
7.8 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 causes improper permission assignment to critical resources, potentially allowing non-privileged local attackers to access sensitive information stored on the device.
5.5 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A path traversal vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 allows privileged local attackers to restore backups from outside the designated backup folder.
4.4 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 allows non-privileged local attackers to interact with the backupmanager service due to improper permission assignments to critical resources.
7.8 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 allows unauthenticated remote attackers to crash the dcpd process by sending specially crafted Profinet packets due to improper validation.
4.3 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 allows unauthenticated remote attackers to crash the dcpd process by sending specially crafted Profinet packets due to improper validation.
4.3 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 allows unauthenticated remote attackers to crash the dcpd process by sending specially crafted Profinet packets due to improper validation.
4.3 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in SCALANCE LPE9403 devices allows an unauthenticated remote attacker to crash the dcpd process by sending multiple Profinet packets in rapid succession, causing a denial of service.
4.3 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A stack-based buffer overflow vulnerability in SCALANCE LPE9403 devices below version V4.0 HF0 allows a non-privileged local attacker to execute arbitrary code or cause denial of service.
6.7 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A stack-based buffer overflow vulnerability in SCALANCE LPE9403 devices below version V4.0 HF0 allows a non-privileged local attacker to execute arbitrary code or cause denial of service.
6.7 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
SCALANCE LPE9403 devices running SINEMA Remote Connect Edge Client versions below V2.1 HF0 are vulnerable to an authentication bypass allowing non-privileged local attackers to read and modify configuration parameters.
7.1 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in SCALANCE LPE9403 devices with SINEMA Remote Connect Edge Client allows non-privileged local attackers to execute root commands due to improper sanitization of configuration parameters in versions earlier than V2.1 HF0.
7.8 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in SCALANCE LPE9403 devices with SINEMA Remote Connect Edge Client versions below V2.1 HF0 allows privileged local attackers to retrieve sensitive information transmitted in cleartext.
4.4 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Wibu CodeMeter versions prior to 8.30a contain a privilege escalation vulnerability occurring immediately after installation when installed without elevated privileges, enabling local users to access a privileged Windows Explorer instance via the CodeMeter Control Center before restart.
8.2 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Keycloak versions prior to 26.7.2 contain a critical reset-credentials vulnerability in the keycloak-services component that allows unauthenticated attackers to bypass email verification and reset any user's password, potentially gaining full account control.
9.1 (Critical)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Multiple Linux kernel vulnerabilities, including the critical 'Copy Fail' flaw in the algif_aead crypto module causing privilege escalation and data corruption, were fixed by reverting to out-of-place operations, affecting various subsystems and vendors such as NetApp and SUSE.
7.8 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Multiple versions of Desigo CC clients are vulnerable to client-side code execution via malicious scripts embedded in user-defined graphics documents, potentially allowing arbitrary file writes and system compromise.
8.2 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in multiple versions of Siveillance Control Pro and Control's OIS web module allows attackers to upload arbitrary files, potentially leading to root access and full system compromise.
9.0 (Critical)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems below version V26.20 allows an authenticated attacker to cause denial of service by crashing the web process via an HTTP-accessible debugging interface.
6.5 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in the firmware update signature validation of CPCI85 Central Processing/Communication and SICORE Base systems (versions below V26.20) allows attackers to install malicious firmware, leading to persistent code execution and system compromise.
6.7 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems below V26.20 arises from default disabled OPC UA security mechanisms, allowing unauthorized access and control over critical system functions.
4.8 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems below V26.20 allows authenticated attackers to bypass security controls and gain elevated privileges via insufficient validation of admin account modifications through the web API.
7.2 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Multiple versions of Teamcenter contain a vulnerability in the authentication redirect flow that allows unauthenticated remote attackers to inject arbitrary JavaScript, potentially compromising authenticated user sessions.
6.1 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in Reyrolle 7SR5 (pre-V2.70) exposes information via its web interface that allows calculation of session ID numbers, enabling attackers to bypass authentication and gain unauthorized device access.
9.8 (Critical)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in Reyrolle 7SR5 (pre-V2.70) allows unauthenticated remote attackers to bypass authentication by predicting or brute-forcing low-entropy session identifiers generated with insufficient randomness.
7.4 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in Reyrolle 7SR5 (pre-V2.70) involves a non-TRNG-initialized random number generator producing predictable security values, enabling unauthenticated attackers to impersonate users and gain unauthorized device access.
7.4 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in Reyrolle 7SR5 versions below V2.70 allows an unauthenticated remote attacker to cause an out-of-bounds write via improper URL length validation in pre-authenticated HTTP messages, resulting in device crashes and denial-of-service.
7.5 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in Reyrolle 7SR5 devices below version 2.70 allows unauthenticated remote attackers to cause denial-of-service by crashing and rebooting the device through excessive concurrent HTTP requests.
7.5 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in Reyrolle 7SR5 versions below V2.70 allows authenticated low-privileged remote attackers to bypass RBAC restrictions and escalate privileges to administrative level via manipulation of request data in the web-based management interface.
8.8 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Reyrolle 7SR5 firmware versions below V2.70 contain debugging symbols in their binaries, enabling unauthenticated attackers to more easily reverse engineer the firmware and potentially discover additional vulnerabilities.
5.3 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in Reyrolle 7SR5 firmware-update mode allows an unauthenticated attacker with physical access to cause memory corruption, leading to device crashes or arbitrary code execution via improper input validation in a proprietary communication protocol.
6.8 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
A vulnerability in Reyrolle 7SR5 (pre-V2.70) allows an attacker with physical access to trigger a maintenance mode during boot that downloads and executes unsigned code from a network server without verification.
6.8 (Medium)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
Multiple versions of SIMOVE Fleetmanager and SIPLANT products contain a directory traversal vulnerability in their embedded HTTP server, allowing unauthenticated remote attackers to read arbitrary files and potentially expose sensitive data such as credentials and private keys.
8.6 (High)
Affected products
Known affected
42 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Siemens / CPCI85 Central Processing/Communication
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC ClickOnce Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Flex Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC Installed Client V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V5.1
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V7
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V8
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Desigo CC family V9
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Industrial Edge Management
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Reyrolle 7SR5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SCALANCE LPE9403
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Common Debian arm64
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC AX Runtime Core Linux VMWare Development
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC CN 4100
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M5
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC Field PG M6
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Basic Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC HMI Comfort Panels
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC IPC Industrial Edge Device OS (IED-OS)
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC PDM Maintenance Station V5.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC WinCC
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / SIMATIC eaSie Core Package
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Simatic IOT2050 Firmware
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siplant
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control Pro V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V3.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Siveillance Control V4.0
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2412
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2506
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2512
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / Teamcenter V2606
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / sicore_base_system
|
vers:unknown/* | ||
|
vers:unknown/*
Siemens / simove Fleet Manager
|
vers:unknown/* |
References
54 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Siemens heeft kwetsbaarheden verholpen in diverse producten als Desigo, Reyrolle, SIMATIC, SCALANCE, SINAMICS en Siveillance.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden stellen een kwaadwillende in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n* Denial-of-Service (DoS)\n* Manipulatie van gegevens\n* Omzeilen van een beveiligingsmaatregel\n* (Remote) code execution (root/admin rechten)\n* (Remote) code execution (gebruikersrechten)\n* Toegang tot gevoelige gegevens\n* Verhogen van rechten\n\nDe kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "De betrokken leveranciers hebben updates uitgebracht om de genoemde kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "Relative Path Traversal",
"title": "CWE-23"
},
{
"category": "general",
"text": "Path Traversal: \u0027.../...//\u0027",
"title": "CWE-35"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "general",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "general",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "general",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "general",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "general",
"text": "Improper Neutralization of Delimiters",
"title": "CWE-140"
},
{
"category": "general",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "general",
"text": "Insertion of Sensitive Information Into Debugging Code",
"title": "CWE-215"
},
{
"category": "general",
"text": "Least Privilege Violation",
"title": "CWE-272"
},
{
"category": "general",
"text": "Authentication Bypass Using an Alternate Path or Channel",
"title": "CWE-288"
},
{
"category": "general",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
},
{
"category": "general",
"text": "Cleartext Transmission of Sensitive Information",
"title": "CWE-319"
},
{
"category": "general",
"text": "Insufficient Entropy",
"title": "CWE-331"
},
{
"category": "general",
"text": "Uncontrolled Search Path Element",
"title": "CWE-427"
},
{
"category": "general",
"text": "Unrestricted Upload of File with Dangerous Type",
"title": "CWE-434"
},
{
"category": "general",
"text": "Use of Uninitialized Variable",
"title": "CWE-457"
},
{
"category": "general",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "general",
"text": "Active Debug Code",
"title": "CWE-489"
},
{
"category": "general",
"text": "Download of Code Without Integrity Check",
"title": "CWE-494"
},
{
"category": "general",
"text": "Unverified Password Change",
"title": "CWE-620"
},
{
"category": "general",
"text": "Weak Password Recovery Mechanism for Forgotten Password",
"title": "CWE-640"
},
{
"category": "general",
"text": "Incorrect Resource Transfer Between Spheres",
"title": "CWE-669"
},
{
"category": "general",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Use of Out-of-range Pointer Offset",
"title": "CWE-823"
},
{
"category": "general",
"text": "Initialization of a Resource with an Insecure Default",
"title": "CWE-1188"
},
{
"category": "general",
"text": "Improper Validation of Consistency within Input",
"title": "CWE-1288"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-142885.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-157465.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-216014.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-229470.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-254516.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-327438.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-328642.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-330084.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-331739.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-434797.html"
},
{
"category": "external",
"summary": "Reference",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-503852.html"
}
],
"title": "Kwetsbaarheden verholpen in Siemens producten",
"tracking": {
"current_release_date": "2026-09-08T13:49:56.829348Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0346",
"initial_release_date": "2026-09-08T13:46:45.990639Z",
"revision_history": [
{
"date": "2026-09-08T13:46:45.990639Z",
"number": "1.0.0",
"summary": "Initiele versie"
},
{
"date": "2026-09-08T13:49:56.829348Z",
"number": "1.0.1",
"summary": "Inschaling stond abusievelijk op Medium/Medium, is aangepast naar Medium/High."
}
],
"status": "final",
"version": "1.0.1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "CPCI85 Central Processing/Communication"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Desigo CC ClickOnce Client V6"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Desigo CC ClickOnce Client V7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Desigo CC Flex Client V6"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Desigo CC Flex Client V7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "Desigo CC Installed Client V6"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "Desigo CC Installed Client V7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "Desigo CC family V5.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "Desigo CC family V5.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "Desigo CC family V6"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "Desigo CC family V7"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "Desigo CC family V8"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-13"
}
}
],
"category": "product_name",
"name": "Desigo CC family V9"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-14"
}
}
],
"category": "product_name",
"name": "Industrial Edge Management"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-15"
}
}
],
"category": "product_name",
"name": "Reyrolle 7SR5"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-16"
}
}
],
"category": "product_name",
"name": "SCALANCE LPE9403"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-17"
}
}
],
"category": "product_name",
"name": "SIMATIC AX Runtime Core Linux Common Debian"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-18"
}
}
],
"category": "product_name",
"name": "SIMATIC AX Runtime Core Linux Common Debian arm64"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-19"
}
}
],
"category": "product_name",
"name": "SIMATIC AX Runtime Core Linux Platform Container Common Debian Development"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-20"
}
}
],
"category": "product_name",
"name": "SIMATIC AX Runtime Core Linux VMWare Development"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-21"
}
}
],
"category": "product_name",
"name": "SIMATIC CN 4100"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-22"
}
}
],
"category": "product_name",
"name": "SIMATIC Field PG M5"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-23"
}
}
],
"category": "product_name",
"name": "SIMATIC Field PG M6"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-24"
}
}
],
"category": "product_name",
"name": "SIMATIC HMI Basic Panels"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-25"
}
}
],
"category": "product_name",
"name": "SIMATIC HMI Comfort Panels"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-26"
}
}
],
"category": "product_name",
"name": "SIMATIC IPC Industrial Edge Device OS (IED-OS)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-27"
}
}
],
"category": "product_name",
"name": "SIMATIC PDM Maintenance Station V5.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-28"
}
}
],
"category": "product_name",
"name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-29"
}
}
],
"category": "product_name",
"name": "SIMATIC WinCC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-30"
}
}
],
"category": "product_name",
"name": "SIMATIC eaSie Core Package"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-31"
}
}
],
"category": "product_name",
"name": "Simatic IOT2050 Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-32"
}
}
],
"category": "product_name",
"name": "Siplant"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-33"
}
}
],
"category": "product_name",
"name": "Siveillance Control Pro V3.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-34"
}
}
],
"category": "product_name",
"name": "Siveillance Control Pro V4.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-35"
}
}
],
"category": "product_name",
"name": "Siveillance Control V3.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-36"
}
}
],
"category": "product_name",
"name": "Siveillance Control V4.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-37"
}
}
],
"category": "product_name",
"name": "Teamcenter V2412"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-38"
}
}
],
"category": "product_name",
"name": "Teamcenter V2506"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-39"
}
}
],
"category": "product_name",
"name": "Teamcenter V2512"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-40"
}
}
],
"category": "product_name",
"name": "Teamcenter V2606"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-41"
}
}
],
"category": "product_name",
"name": "sicore_base_system"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-42"
}
}
],
"category": "product_name",
"name": "simove Fleet Manager"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-42384",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "description",
"text": "Cesanta Mongoose Web Server v7.14 contains an Integer Overflow vulnerability that can be exploited by sending malformed TLS packets, resulting in a segmentation fault and application crash.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-42384 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-42384.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2024-42384"
},
{
"cve": "CVE-2024-42385",
"cwe": {
"id": "CWE-140",
"name": "Improper Neutralization of Delimiters"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Delimiters",
"title": "CWE-140"
},
{
"category": "description",
"text": "Cesanta Mongoose Web Server v7.14 contains an Improper Neutralization of Delimiters vulnerability that can lead to out-of-bound memory writes when processing PEM certificates with unexpected characters.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-42385 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-42385.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2024-42385"
},
{
"cve": "CVE-2024-42386",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"notes": [
{
"category": "other",
"text": "Use of Out-of-range Pointer Offset",
"title": "CWE-823"
},
{
"category": "description",
"text": "A vulnerability in Cesanta Mongoose Web Server v7.14 allows attackers to trigger a segmentation fault by sending a malformed TLS packet that causes an out-of-range pointer offset.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-42386 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-42386.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2024-42386"
},
{
"cve": "CVE-2024-42391",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"notes": [
{
"category": "other",
"text": "Use of Out-of-range Pointer Offset",
"title": "CWE-823"
},
{
"category": "description",
"text": "A vulnerability in Cesanta Mongoose Web Server v7.14 allows attackers to send crafted TLS packets that trigger out-of-range pointer offsets, causing the application to read unintended heap memory.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-42391 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-42391.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2024-42391"
},
{
"cve": "CVE-2024-42392",
"cwe": {
"id": "CWE-140",
"name": "Improper Neutralization of Delimiters"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Delimiters",
"title": "CWE-140"
},
{
"category": "description",
"text": "Cesanta Mongoose Web Server v7.14 contains an Improper Neutralization of Delimiters vulnerability that can trigger an infinite loop when processing input strings with unexpected characters.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-42392 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-42392.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2024-42392"
},
{
"cve": "CVE-2024-56181",
"notes": [
{
"category": "description",
"text": "Multiple SIMATIC devices with certain versions have insufficient protection of EFI variables, allowing an authenticated attacker to alter secure boot configuration via direct communication with the flash controller.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-56181 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-56181.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2024-56181"
},
{
"cve": "CVE-2024-56182",
"notes": [
{
"category": "description",
"text": "Multiple SIMATIC device models with certain versions have a vulnerability due to insufficient EFI variable protection, allowing an authenticated attacker to disable the BIOS password via direct flash controller communication.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-56182 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-56182.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2024-56182"
},
{
"cve": "CVE-2025-15467",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "other",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "description",
"text": "OpenSSL 3.x contains a stack buffer overflow vulnerability in CMS AuthEnvelopedData parsing with oversized IVs in AEAD ciphers that can cause crashes or remote code execution, affecting multiple products including Red Hat and NetApp, while versions 1.1.1 and 1.0.2 remain unaffected.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-15467 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-15467.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-15467"
},
{
"cve": "CVE-2025-30033",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Search Path Element",
"title": "CWE-427"
},
{
"category": "description",
"text": "A setup component is vulnerable to DLL hijacking, enabling attackers to execute arbitrary code during legitimate application installations.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30033 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-30033.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-30033"
},
{
"cve": "CVE-2025-40572",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "other",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "description",
"text": "A vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 causes improper permission assignment to critical resources, potentially allowing non-privileged local attackers to access sensitive information stored on the device.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40572 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40572.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40572"
},
{
"cve": "CVE-2025-40573",
"cwe": {
"id": "CWE-35",
"name": "Path Traversal: \u0027.../...//\u0027"
},
"notes": [
{
"category": "other",
"text": "Path Traversal: \u0027.../...//\u0027",
"title": "CWE-35"
},
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "description",
"text": "A path traversal vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 allows privileged local attackers to restore backups from outside the designated backup folder.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40573 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40573.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40573"
},
{
"cve": "CVE-2025-40574",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "other",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "description",
"text": "A vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 allows non-privileged local attackers to interact with the backupmanager service due to improper permission assignments to critical resources.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40574 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40574.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40574"
},
{
"cve": "CVE-2025-40575",
"cwe": {
"id": "CWE-457",
"name": "Use of Uninitialized Variable"
},
"notes": [
{
"category": "other",
"text": "Use of Uninitialized Variable",
"title": "CWE-457"
},
{
"category": "description",
"text": "A vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 allows unauthenticated remote attackers to crash the dcpd process by sending specially crafted Profinet packets due to improper validation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40575 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40575.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40575"
},
{
"cve": "CVE-2025-40576",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "A vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 allows unauthenticated remote attackers to crash the dcpd process by sending specially crafted Profinet packets due to improper validation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40576 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40576.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40576"
},
{
"cve": "CVE-2025-40577",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "description",
"text": "A vulnerability in SCALANCE LPE9403 devices before V4.0 HF0 allows unauthenticated remote attackers to crash the dcpd process by sending specially crafted Profinet packets due to improper validation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40577 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40577.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40577"
},
{
"cve": "CVE-2025-40578",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "description",
"text": "A vulnerability in SCALANCE LPE9403 devices allows an unauthenticated remote attacker to crash the dcpd process by sending multiple Profinet packets in rapid succession, causing a denial of service.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40578 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40578.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40578"
},
{
"cve": "CVE-2025-40579",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A stack-based buffer overflow vulnerability in SCALANCE LPE9403 devices below version V4.0 HF0 allows a non-privileged local attacker to execute arbitrary code or cause denial of service.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40579 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40579.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40579"
},
{
"cve": "CVE-2025-40580",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A stack-based buffer overflow vulnerability in SCALANCE LPE9403 devices below version V4.0 HF0 allows a non-privileged local attacker to execute arbitrary code or cause denial of service.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40580 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40580.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40580"
},
{
"cve": "CVE-2025-40581",
"cwe": {
"id": "CWE-288",
"name": "Authentication Bypass Using an Alternate Path or Channel"
},
"notes": [
{
"category": "other",
"text": "Authentication Bypass Using an Alternate Path or Channel",
"title": "CWE-288"
},
{
"category": "description",
"text": "SCALANCE LPE9403 devices running SINEMA Remote Connect Edge Client versions below V2.1 HF0 are vulnerable to an authentication bypass allowing non-privileged local attackers to read and modify configuration parameters.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40581 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40581.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40581"
},
{
"cve": "CVE-2025-40582",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "description",
"text": "A vulnerability in SCALANCE LPE9403 devices with SINEMA Remote Connect Edge Client allows non-privileged local attackers to execute root commands due to improper sanitization of configuration parameters in versions earlier than V2.1 HF0.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40582 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40582.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40582"
},
{
"cve": "CVE-2025-40583",
"cwe": {
"id": "CWE-319",
"name": "Cleartext Transmission of Sensitive Information"
},
"notes": [
{
"category": "other",
"text": "Cleartext Transmission of Sensitive Information",
"title": "CWE-319"
},
{
"category": "description",
"text": "A vulnerability in SCALANCE LPE9403 devices with SINEMA Remote Connect Edge Client versions below V2.1 HF0 allows privileged local attackers to retrieve sensitive information transmitted in cleartext.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-40583 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-40583.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-40583"
},
{
"cve": "CVE-2025-47809",
"cwe": {
"id": "CWE-272",
"name": "Least Privilege Violation"
},
"notes": [
{
"category": "other",
"text": "Least Privilege Violation",
"title": "CWE-272"
},
{
"category": "description",
"text": "Wibu CodeMeter versions prior to 8.30a contain a privilege escalation vulnerability occurring immediately after installation when installed without elevated privileges, enabling local users to access a privileged Windows Explorer instance via the CodeMeter Control Center before restart.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-47809 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47809.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2025-47809"
},
{
"cve": "CVE-2026-18963",
"cwe": {
"id": "CWE-640",
"name": "Weak Password Recovery Mechanism for Forgotten Password"
},
"notes": [
{
"category": "other",
"text": "Weak Password Recovery Mechanism for Forgotten Password",
"title": "CWE-640"
},
{
"category": "description",
"text": "Keycloak versions prior to 26.7.2 contain a critical reset-credentials vulnerability in the keycloak-services component that allows unauthenticated attackers to bypass email verification and reset any user\u0027s password, potentially gaining full account control.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-18963 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18963.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-18963"
},
{
"cve": "CVE-2026-31431",
"cwe": {
"id": "CWE-1288",
"name": "Improper Validation of Consistency within Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Consistency within Input",
"title": "CWE-1288"
},
{
"category": "other",
"text": "Incorrect Resource Transfer Between Spheres",
"title": "CWE-669"
},
{
"category": "description",
"text": "Multiple Linux kernel vulnerabilities, including the critical \u0027Copy Fail\u0027 flaw in the algif_aead crypto module causing privilege escalation and data corruption, were fixed by reverting to out-of-place operations, affecting various subsystems and vendors such as NetApp and SUSE.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-31431 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-31431.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-31431"
},
{
"cve": "CVE-2026-34223",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "description",
"text": "Multiple versions of Desigo CC clients are vulnerable to client-side code execution via malicious scripts embedded in user-defined graphics documents, potentially allowing arbitrary file writes and system compromise.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-34223 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-34223.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-34223"
},
{
"cve": "CVE-2026-50093",
"cwe": {
"id": "CWE-434",
"name": "Unrestricted Upload of File with Dangerous Type"
},
"notes": [
{
"category": "other",
"text": "Unrestricted Upload of File with Dangerous Type",
"title": "CWE-434"
},
{
"category": "description",
"text": "A vulnerability in multiple versions of Siveillance Control Pro and Control\u0027s OIS web module allows attackers to upload arbitrary files, potentially leading to root access and full system compromise.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-50093 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-50093.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-50093"
},
{
"cve": "CVE-2026-54798",
"cwe": {
"id": "CWE-489",
"name": "Active Debug Code"
},
"notes": [
{
"category": "other",
"text": "Active Debug Code",
"title": "CWE-489"
},
{
"category": "description",
"text": "A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems below version V26.20 allows an authenticated attacker to cause denial of service by crashing the web process via an HTTP-accessible debugging interface.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-54798 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-54798.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-54798"
},
{
"cve": "CVE-2026-54799",
"cwe": {
"id": "CWE-489",
"name": "Active Debug Code"
},
"notes": [
{
"category": "other",
"text": "Active Debug Code",
"title": "CWE-489"
},
{
"category": "description",
"text": "A vulnerability in the firmware update signature validation of CPCI85 Central Processing/Communication and SICORE Base systems (versions below V26.20) allows attackers to install malicious firmware, leading to persistent code execution and system compromise.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-54799 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-54799.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-54799"
},
{
"cve": "CVE-2026-54800",
"cwe": {
"id": "CWE-1188",
"name": "Initialization of a Resource with an Insecure Default"
},
"notes": [
{
"category": "other",
"text": "Initialization of a Resource with an Insecure Default",
"title": "CWE-1188"
},
{
"category": "description",
"text": "A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems below V26.20 arises from default disabled OPC UA security mechanisms, allowing unauthorized access and control over critical system functions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-54800 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-54800.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-54800"
},
{
"cve": "CVE-2026-54801",
"cwe": {
"id": "CWE-620",
"name": "Unverified Password Change"
},
"notes": [
{
"category": "other",
"text": "Unverified Password Change",
"title": "CWE-620"
},
{
"category": "description",
"text": "A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems below V26.20 allows authenticated attackers to bypass security controls and gain elevated privileges via insufficient validation of admin account modifications through the web API.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-54801 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-54801.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-54801"
},
{
"cve": "CVE-2026-58113",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "description",
"text": "Multiple versions of Teamcenter contain a vulnerability in the authentication redirect flow that allows unauthenticated remote attackers to inject arbitrary JavaScript, potentially compromising authenticated user sessions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-58113 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58113.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-58113"
},
{
"cve": "CVE-2026-62645",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "other",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
},
{
"category": "description",
"text": "A vulnerability in Reyrolle 7SR5 (pre-V2.70) exposes information via its web interface that allows calculation of session ID numbers, enabling attackers to bypass authentication and gain unauthorized device access.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62645 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62645.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-62645"
},
{
"cve": "CVE-2026-62646",
"cwe": {
"id": "CWE-331",
"name": "Insufficient Entropy"
},
"notes": [
{
"category": "other",
"text": "Insufficient Entropy",
"title": "CWE-331"
},
{
"category": "description",
"text": "A vulnerability in Reyrolle 7SR5 (pre-V2.70) allows unauthenticated remote attackers to bypass authentication by predicting or brute-forcing low-entropy session identifiers generated with insufficient randomness.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62646 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62646.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-62646"
},
{
"cve": "CVE-2026-62647",
"notes": [
{
"category": "description",
"text": "A vulnerability in Reyrolle 7SR5 (pre-V2.70) involves a non-TRNG-initialized random number generator producing predictable security values, enabling unauthenticated attackers to impersonate users and gain unauthorized device access.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62647 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62647.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-62647"
},
{
"cve": "CVE-2026-62648",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A vulnerability in Reyrolle 7SR5 versions below V2.70 allows an unauthenticated remote attacker to cause an out-of-bounds write via improper URL length validation in pre-authenticated HTTP messages, resulting in device crashes and denial-of-service.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62648 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62648.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-62648"
},
{
"cve": "CVE-2026-62649",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "A vulnerability in Reyrolle 7SR5 devices below version 2.70 allows unauthenticated remote attackers to cause denial-of-service by crashing and rebooting the device through excessive concurrent HTTP requests.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62649 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62649.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-62649"
},
{
"cve": "CVE-2026-62650",
"cwe": {
"id": "CWE-288",
"name": "Authentication Bypass Using an Alternate Path or Channel"
},
"notes": [
{
"category": "other",
"text": "Authentication Bypass Using an Alternate Path or Channel",
"title": "CWE-288"
},
{
"category": "description",
"text": "A vulnerability in Reyrolle 7SR5 versions below V2.70 allows authenticated low-privileged remote attackers to bypass RBAC restrictions and escalate privileges to administrative level via manipulation of request data in the web-based management interface.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62650 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62650.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-62650"
},
{
"cve": "CVE-2026-62652",
"cwe": {
"id": "CWE-215",
"name": "Insertion of Sensitive Information Into Debugging Code"
},
"notes": [
{
"category": "other",
"text": "Insertion of Sensitive Information Into Debugging Code",
"title": "CWE-215"
},
{
"category": "description",
"text": "Reyrolle 7SR5 firmware versions below V2.70 contain debugging symbols in their binaries, enabling unauthenticated attackers to more easily reverse engineer the firmware and potentially discover additional vulnerabilities.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62652 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62652.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-62652"
},
{
"cve": "CVE-2026-62653",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A vulnerability in Reyrolle 7SR5 firmware-update mode allows an unauthenticated attacker with physical access to cause memory corruption, leading to device crashes or arbitrary code execution via improper input validation in a proprietary communication protocol.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62653 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62653.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-62653"
},
{
"cve": "CVE-2026-62654",
"cwe": {
"id": "CWE-494",
"name": "Download of Code Without Integrity Check"
},
"notes": [
{
"category": "other",
"text": "Download of Code Without Integrity Check",
"title": "CWE-494"
},
{
"category": "description",
"text": "A vulnerability in Reyrolle 7SR5 (pre-V2.70) allows an attacker with physical access to trigger a maintenance mode during boot that downloads and executes unsigned code from a network server without verification.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62654 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62654.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-62654"
},
{
"cve": "CVE-2026-67367",
"cwe": {
"id": "CWE-23",
"name": "Relative Path Traversal"
},
"notes": [
{
"category": "other",
"text": "Relative Path Traversal",
"title": "CWE-23"
},
{
"category": "description",
"text": "Multiple versions of SIMOVE Fleetmanager and SIPLANT products contain a directory traversal vulnerability in their embedded HTTP server, allowing unauthenticated remote attackers to read arbitrary files and potentially expose sensitive data such as credentials and private keys.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-67367 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-67367.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36",
"CSAFPID-37",
"CSAFPID-38",
"CSAFPID-39",
"CSAFPID-40",
"CSAFPID-41",
"CSAFPID-42"
]
}
],
"title": "CVE-2026-67367"
}
]
}
RHSA-2026:56519
Vulnerability from csaf_redhat - Published: 2026-08-18 20:49 - Updated: 2026-08-27 01:56Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Images Security Update
Severity
Critical
Notes
Topic: New images are available for Red Hat build of Keycloak 26.4.15 and Red Hat build of Keycloak 26.4.15 Operator, running on OpenShift Container Platform
Details: Red Hat build of Keycloak is an integrated sign-on solution,
available as a Red Hat JBoss Middleware for OpenShift containerized
image. The Red Hat build of Keycloak for OpenShift image provides
an authentication server that you can use to log in centrally, log
out, and register. You can also manage user accounts for web
applications, mobile applications, and RESTful web services.
Red Hat build of Keycloak Operator for OpenShift simplifies
deployment and management of Keycloak 26.4.15 clusters.
This erratum releases new images for Red Hat build of Keycloak
26.4.15 for use within the OpenShift Container Platform cloud
computing Platform-as-a-Service (PaaS) for on-premise or private
cloud deployments, aligning with the standalone product release.
Security fixes:
* Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
9.1 (Critical)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Critical
References
7 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "New images are available for Red Hat build of Keycloak 26.4.15 and Red Hat build of Keycloak 26.4.15 Operator, running on OpenShift Container Platform",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Keycloak is an integrated sign-on solution,\navailable as a Red Hat JBoss Middleware for OpenShift containerized\nimage. The Red Hat build of Keycloak for OpenShift image provides\nan authentication server that you can use to log in centrally, log\nout, and register. You can also manage user accounts for web\napplications, mobile applications, and RESTful web services.\n\nRed Hat build of Keycloak Operator for OpenShift simplifies\ndeployment and management of Keycloak 26.4.15 clusters.\n\nThis erratum releases new images for Red Hat build of Keycloak\n26.4.15 for use within the OpenShift Container Platform cloud\ncomputing Platform-as-a-Service (PaaS) for on-premise or private\ncloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:56519",
"url": "https://access.redhat.com/errata/RHSA-2026:56519"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56519.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Images Security Update",
"tracking": {
"current_release_date": "2026-08-27T01:56:02+00:00",
"generator": {
"date": "2026-08-27T01:56:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:56519",
"initial_release_date": "2026-08-18T20:49:21+00:00",
"revision_history": [
{
"date": "2026-08-18T20:49:21+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-18T20:49:21+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-27T01:56:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Keycloak 26.4",
"product": {
"name": "Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:build_keycloak:26.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Keycloak"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64",
"product_id": "rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-23"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-23"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
"product_id": "rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-23"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
"product": {
"name": "rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
"product_id": "rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=26.4.15-1"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-23"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
"product_id": "rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-23"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-23"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
"product_id": "rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-23"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-23"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64 as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64"
},
"product_reference": "rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64 as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64 as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64 as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
"relates_to_product_reference": "9Base-RHBK-26.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64 as a component of Red Hat build of Keycloak 26.4",
"product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64",
"relates_to_product_reference": "9Base-RHBK-26.4"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"James Paremain"
]
}
],
"cve": "CVE-2026-18963",
"cwe": {
"id": "CWE-640",
"name": "Weak Password Recovery Mechanism for Forgotten Password"
},
"discovery_date": "2026-07-31T15:46:15+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511595"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Critical, given that it can be exploited by an unauthenticated remote attacker without any user interaction. Successful exploitation allows an attacker to gain full access to any user account by bypassing the email verification step in the password recovery process. The vulnerability\u0027s root cause is improper state validation within the reset-credentials authentication flow.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18963"
},
{
"category": "external",
"summary": "RHBZ#2511595",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18963"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963"
}
],
"release_date": "2026-08-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:49:21+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56519"
},
{
"category": "workaround",
"details": "If an immediate upgrade is not possible, disabling the \"Forgot password\" functionality across all realms can be used as a temporary mitigation.\n\nIn the RHBK administration console, navigate to:\n\nRealm settings \u2192 Login \u2192 Forgot password \u2192 Off\n\nApply this setting to all realms.\n\nUpgrade to a fixed version as soon as possible.",
"product_ids": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
"9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass"
}
]
}
RHSA-2026:56520
Vulnerability from csaf_redhat - Published: 2026-08-18 20:36 - Updated: 2026-09-01 01:53Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Security Update
Severity
Critical
Notes
Topic: New Red Hat build of Keycloak 26.4.15 packages are available from the Customer Portal
Details: Red Hat build of Keycloak 26.4.15 is a standalone server, based on
the Keycloak project, that provides authentication and
standards-based single sign-on capabilities for web and mobile
applications.
Security fixes:
* Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Keycloak 26.4.15
Red Hat / Red Hat build of Keycloak
|
cpe:/a:redhat:build_keycloak:26.4
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Critical
References
7 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "New Red Hat build of Keycloak 26.4.15 packages are available from the Customer Portal",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Keycloak 26.4.15 is a standalone server, based on\nthe Keycloak project, that provides authentication and\nstandards-based single sign-on capabilities for web and mobile\napplications.\n\nSecurity fixes:\n* Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:56520",
"url": "https://access.redhat.com/errata/RHSA-2026:56520"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56520.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Security Update",
"tracking": {
"current_release_date": "2026-09-01T01:53:37+00:00",
"generator": {
"date": "2026-09-01T01:53:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:56520",
"initial_release_date": "2026-08-18T20:36:54+00:00",
"revision_history": [
{
"date": "2026-08-18T20:36:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-18T20:36:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-01T01:53:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Keycloak 26.4.15",
"product": {
"name": "Red Hat build of Keycloak 26.4.15",
"product_id": "Red Hat build of Keycloak 26.4.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:build_keycloak:26.4"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Keycloak"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"James Paremain"
]
}
],
"cve": "CVE-2026-18963",
"cwe": {
"id": "CWE-640",
"name": "Weak Password Recovery Mechanism for Forgotten Password"
},
"discovery_date": "2026-07-31T15:46:15+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511595"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Critical, given that it can be exploited by an unauthenticated remote attacker without any user interaction. Successful exploitation allows an attacker to gain full access to any user account by bypassing the email verification step in the password recovery process. The vulnerability\u0027s root cause is improper state validation within the reset-credentials authentication flow.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.15"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18963"
},
{
"category": "external",
"summary": "RHBZ#2511595",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18963"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963"
}
],
"release_date": "2026-08-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:36:54+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.15"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56520"
},
{
"category": "workaround",
"details": "If an immediate upgrade is not possible, disabling the \"Forgot password\" functionality across all realms can be used as a temporary mitigation.\n\nIn the RHBK administration console, navigate to:\n\nRealm settings \u2192 Login \u2192 Forgot password \u2192 Off\n\nApply this setting to all realms.\n\nUpgrade to a fixed version as soon as possible.",
"product_ids": [
"Red Hat build of Keycloak 26.4.15"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.15"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass"
}
]
}
RHSA-2026:56523
Vulnerability from csaf_redhat - Published: 2026-08-18 20:37 - Updated: 2026-09-01 01:53Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.6.6 Security Update
Severity
Critical
Notes
Topic: New Red Hat build of Keycloak 26.6.6 packages are available from the Customer Portal
Details: Red Hat build of Keycloak 26.6.6 is a standalone server, based on
the Keycloak project, that provides authentication and
standards-based single sign-on capabilities for web and mobile
applications.
Security fixes:
* FGAP v2 role groups endpoint discloses hidden group metadata without group view permission (CVE-2026-14613)
* Predictable account-linking hash enables account takeover via malicious OIDC client (CVE-2026-15571)
* Vault-resolved rotated client secrets leaked via Admin REST API (CVE-2026-17048)
* Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
* Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CVE-2026-9796)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Keycloak 26.6.6
Red Hat / Red Hat build of Keycloak
|
cpe:/a:redhat:build_keycloak:26.6
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.
4.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Keycloak 26.6.6
Red Hat / Red Hat build of Keycloak
|
cpe:/a:redhat:build_keycloak:26.6
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Keycloak 26.6.6
Red Hat / Red Hat build of Keycloak
|
cpe:/a:redhat:build_keycloak:26.6
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.
5.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Keycloak 26.6.6
Red Hat / Red Hat build of Keycloak
|
cpe:/a:redhat:build_keycloak:26.6
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Keycloak 26.6.6
Red Hat / Red Hat build of Keycloak
|
cpe:/a:redhat:build_keycloak:26.6
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Critical
References
23 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "New Red Hat build of Keycloak 26.6.6 packages are available from the Customer Portal",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Keycloak 26.6.6 is a standalone server, based on\nthe Keycloak project, that provides authentication and\nstandards-based single sign-on capabilities for web and mobile\napplications.\n\nSecurity fixes:\n* FGAP v2 role groups endpoint discloses hidden group metadata without group view permission (CVE-2026-14613)\n* Predictable account-linking hash enables account takeover via malicious OIDC client (CVE-2026-15571)\n* Vault-resolved rotated client secrets leaked via Admin REST API (CVE-2026-17048)\n* Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)\n* Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CVE-2026-9796)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:56523",
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56523.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.6.6 Security Update",
"tracking": {
"current_release_date": "2026-09-01T01:53:32+00:00",
"generator": {
"date": "2026-09-01T01:53:32+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:56523",
"initial_release_date": "2026-08-18T20:37:40+00:00",
"revision_history": [
{
"date": "2026-08-18T20:37:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-18T20:37:40+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-01T01:53:32+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Keycloak 26.6.6",
"product": {
"name": "Red Hat build of Keycloak 26.6.6",
"product_id": "Red Hat build of Keycloak 26.6.6",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:build_keycloak:26.6"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Keycloak"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Uri Rolls",
"Lior Moshe",
"Daniel Peters"
],
"organization": "Operating Intelligence Inc."
}
],
"cve": "CVE-2026-9796",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-05-28T03:31:32.052000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker\u0027s own permissions are revoked and across system reboots.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate privilege escalation flaw exists in Keycloak where an authenticated administrator with `manage-clients` privileges can exploit a Time-of-Check to Time-of-Use (TOCTOU) vulnerability. This allows them to escalate their privileges to `realm-admin` for all users within the realm, impacting the integrity of role-based access control.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.6.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9796"
},
{
"category": "external",
"summary": "RHBZ#2482464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9796"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9796",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9796"
}
],
"release_date": "2026-05-28T03:32:50.762000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:37:40+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.6.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.6.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.6.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-14613",
"cwe": {
"id": "CWE-1220",
"name": "Insufficient Granularity of Access Control"
},
"discovery_date": "2026-07-02T17:56:34+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496878"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in Keycloak\u0027s administrative interface that allows certain administrators to see information about groups they shouldn\u0027t have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific \"role\" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover \"hidden\" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate. While it allows for an unauthorized disclosure of group metadata, it requires the attacker to already possess a delegated administrative role with specific view permissions. The vulnerability is a result of a missing authorization check in the RoleContainerResource component when FGAP v2 is active. Direct access to the hidden groups remains protected; the leak occurs only through the role-to-group mapping enumeration endpoint.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.6.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14613"
},
{
"category": "external",
"summary": "RHBZ#2496878",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496878"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14613",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14613"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14613",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14613"
}
],
"release_date": "2026-07-03T15:04:48.779000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:37:40+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.6.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.6.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-15571",
"cwe": {
"id": "CWE-341",
"name": "Predictable from Observable State"
},
"discovery_date": "2026-07-07T18:49:21+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499591"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim\u0027s account to an attacker\u0027s external identity. This results in a full account takeover, allowing the attacker to log in as the victim.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Predictable account-linking hash enables account takeover via malicious OIDC client",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it enables full account takeover through a predictable security hash. Successful exploitation allows an attacker to link an unauthorized identity to a victim\u0027s account and subsequently impersonate that user across the realm. The vulnerability\u0027s root cause is the use of predictable session identifiers and client-known metadata in the construction of the account-linking CSRF protection hash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.6.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15571"
},
{
"category": "external",
"summary": "RHBZ#2499591",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499591"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15571",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15571"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15571",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15571"
}
],
"release_date": "2026-08-18T19:41:18.051000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:37:40+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.6.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.6.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Predictable account-linking hash enables account takeover via malicious OIDC client"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-17048",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2026-07-21T10:47:21+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2506743"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires high-privileged administrative access and the use of a non-default preview feature. Successful exploitation allows an attacker to disclose sensitive vault-backed rotated client secrets. The vulnerability\u0027s root cause is a failure to properly mask resolved vault values in the rotated client secret API endpoint.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.6.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-17048"
},
{
"category": "external",
"summary": "RHBZ#2506743",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506743"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-17048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-17048"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-17048",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17048"
}
],
"release_date": "2026-07-21T10:47:21+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:37:40+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.6.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.6.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.6.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API"
},
{
"acknowledgments": [
{
"names": [
"James Paremain"
]
}
],
"cve": "CVE-2026-18963",
"cwe": {
"id": "CWE-640",
"name": "Weak Password Recovery Mechanism for Forgotten Password"
},
"discovery_date": "2026-07-31T15:46:15+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511595"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Critical, given that it can be exploited by an unauthenticated remote attacker without any user interaction. Successful exploitation allows an attacker to gain full access to any user account by bypassing the email verification step in the password recovery process. The vulnerability\u0027s root cause is improper state validation within the reset-credentials authentication flow.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.6.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18963"
},
{
"category": "external",
"summary": "RHBZ#2511595",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18963"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963"
}
],
"release_date": "2026-08-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:37:40+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.6.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
},
{
"category": "workaround",
"details": "If an immediate upgrade is not possible, disabling the \"Forgot password\" functionality across all realms can be used as a temporary mitigation.\n\nIn the RHBK administration console, navigate to:\n\nRealm settings \u2192 Login \u2192 Forgot password \u2192 Off\n\nApply this setting to all realms.\n\nUpgrade to a fixed version as soon as possible.",
"product_ids": [
"Red Hat build of Keycloak 26.6.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.6.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass"
}
]
}
RHSA-2026:56524
Vulnerability from csaf_redhat - Published: 2026-08-18 20:44 - Updated: 2026-08-31 09:55Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.6.6 Images Security Update
Severity
Critical
Notes
Topic: New images are available for Red Hat build of Keycloak 26.6.6 and
Red Hat build of Keycloak 26.6.6 Operator, running on OpenShift
Container Platform
Details: Red Hat build of Keycloak is an integrated sign-on solution,
available as a Red Hat JBoss Middleware for OpenShift containerized
image. The Red Hat build of Keycloak for OpenShift image provides
an authentication server that you can use to log in centrally, log
out, and register. You can also manage user accounts for web
applications, mobile applications, and RESTful web services.
Red Hat build of Keycloak Operator for OpenShift simplifies
deployment and management of Keycloak 26.6.6 clusters.
This erratum releases new images for Red Hat build of Keycloak
26.6.6 for use within the OpenShift Container Platform cloud
computing Platform-as-a-Service (PaaS) for on-premise or private
cloud deployments, aligning with the standalone product release.
Security fixes:
* FGAP v2 role groups endpoint discloses hidden group metadata without group view permission (CVE-2026-14613)
* Predictable account-linking hash enables account takeover via malicious OIDC client (CVE-2026-15571)
* Vault-resolved rotated client secrets leaked via Admin REST API (CVE-2026-17048)
* Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
* Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CVE-2026-9796)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
6.5 (Medium)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.
4.3 (Medium)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.
7.3 (High)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.
5.5 (Medium)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
9.1 (Critical)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Critical
References
23 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "New images are available for Red Hat build of Keycloak 26.6.6 and\nRed Hat build of Keycloak 26.6.6 Operator, running on OpenShift\nContainer Platform",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Keycloak is an integrated sign-on solution,\navailable as a Red Hat JBoss Middleware for OpenShift containerized\nimage. The Red Hat build of Keycloak for OpenShift image provides\nan authentication server that you can use to log in centrally, log\nout, and register. You can also manage user accounts for web\napplications, mobile applications, and RESTful web services.\n\nRed Hat build of Keycloak Operator for OpenShift simplifies\ndeployment and management of Keycloak 26.6.6 clusters.\n\nThis erratum releases new images for Red Hat build of Keycloak\n26.6.6 for use within the OpenShift Container Platform cloud\ncomputing Platform-as-a-Service (PaaS) for on-premise or private\ncloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* FGAP v2 role groups endpoint discloses hidden group metadata without group view permission (CVE-2026-14613)\n* Predictable account-linking hash enables account takeover via malicious OIDC client (CVE-2026-15571)\n* Vault-resolved rotated client secrets leaked via Admin REST API (CVE-2026-17048)\n* Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)\n* Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CVE-2026-9796)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:56524",
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56524.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.6.6 Images Security Update",
"tracking": {
"current_release_date": "2026-08-31T09:55:00+00:00",
"generator": {
"date": "2026-08-31T09:55:00+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:56524",
"initial_release_date": "2026-08-18T20:44:39+00:00",
"revision_history": [
{
"date": "2026-08-18T20:44:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-18T20:44:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-31T09:55:00+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Keycloak 26.6",
"product": {
"name": "Red Hat build of Keycloak 26.6",
"product_id": "9Base-RHBK-26.6",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:build_keycloak:26.6::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Keycloak"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x",
"product_id": "rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.6-12"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.6-12"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"product_id": "rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.6-12"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"product": {
"name": "rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"product_id": "rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=26.6.6-1"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.6-12"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"product_id": "rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.6-12"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.6-12"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"product": {
"name": "rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"product_id": "rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.6-12"
}
}
},
{
"category": "product_version",
"name": "rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"product": {
"name": "rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"product_id": "rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.6-12"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64 as a component of Red Hat build of Keycloak 26.6",
"product_id": "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64"
},
"product_reference": "rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"relates_to_product_reference": "9Base-RHBK-26.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64 as a component of Red Hat build of Keycloak 26.6",
"product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"relates_to_product_reference": "9Base-RHBK-26.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x as a component of Red Hat build of Keycloak 26.6",
"product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"relates_to_product_reference": "9Base-RHBK-26.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64 as a component of Red Hat build of Keycloak 26.6",
"product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"relates_to_product_reference": "9Base-RHBK-26.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le as a component of Red Hat build of Keycloak 26.6",
"product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le"
},
"product_reference": "rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"relates_to_product_reference": "9Base-RHBK-26.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64 as a component of Red Hat build of Keycloak 26.6",
"product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"relates_to_product_reference": "9Base-RHBK-26.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64 as a component of Red Hat build of Keycloak 26.6",
"product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"relates_to_product_reference": "9Base-RHBK-26.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le as a component of Red Hat build of Keycloak 26.6",
"product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"relates_to_product_reference": "9Base-RHBK-26.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x as a component of Red Hat build of Keycloak 26.6",
"product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
},
"product_reference": "rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x",
"relates_to_product_reference": "9Base-RHBK-26.6"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Uri Rolls",
"Lior Moshe",
"Daniel Peters"
],
"organization": "Operating Intelligence Inc."
}
],
"cve": "CVE-2026-9796",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-05-28T03:31:32.052000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker\u0027s own permissions are revoked and across system reboots.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate privilege escalation flaw exists in Keycloak where an authenticated administrator with `manage-clients` privileges can exploit a Time-of-Check to Time-of-Use (TOCTOU) vulnerability. This allows them to escalate their privileges to `realm-admin` for all users within the realm, impacting the integrity of role-based access control.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9796"
},
{
"category": "external",
"summary": "RHBZ#2482464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9796"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9796",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9796"
}
],
"release_date": "2026-05-28T03:32:50.762000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:44:39+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-14613",
"cwe": {
"id": "CWE-1220",
"name": "Insufficient Granularity of Access Control"
},
"discovery_date": "2026-07-02T17:56:34+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496878"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered in Keycloak\u0027s administrative interface that allows certain administrators to see information about groups they shouldn\u0027t have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific \"role\" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover \"hidden\" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate. While it allows for an unauthorized disclosure of group metadata, it requires the attacker to already possess a delegated administrative role with specific view permissions. The vulnerability is a result of a missing authorization check in the RoleContainerResource component when FGAP v2 is active. Direct access to the hidden groups remains protected; the leak occurs only through the role-to-group mapping enumeration endpoint.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14613"
},
{
"category": "external",
"summary": "RHBZ#2496878",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496878"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14613",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14613"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14613",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14613"
}
],
"release_date": "2026-07-03T15:04:48.779000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:44:39+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-15571",
"cwe": {
"id": "CWE-341",
"name": "Predictable from Observable State"
},
"discovery_date": "2026-07-07T18:49:21+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499591"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim\u0027s account to an attacker\u0027s external identity. This results in a full account takeover, allowing the attacker to log in as the victim.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Predictable account-linking hash enables account takeover via malicious OIDC client",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it enables full account takeover through a predictable security hash. Successful exploitation allows an attacker to link an unauthorized identity to a victim\u0027s account and subsequently impersonate that user across the realm. The vulnerability\u0027s root cause is the use of predictable session identifiers and client-known metadata in the construction of the account-linking CSRF protection hash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15571"
},
{
"category": "external",
"summary": "RHBZ#2499591",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499591"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15571",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15571"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15571",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15571"
}
],
"release_date": "2026-08-18T19:41:18.051000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:44:39+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Predictable account-linking hash enables account takeover via malicious OIDC client"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-17048",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2026-07-21T10:47:21+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2506743"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires high-privileged administrative access and the use of a non-default preview feature. Successful exploitation allows an attacker to disclose sensitive vault-backed rotated client secrets. The vulnerability\u0027s root cause is a failure to properly mask resolved vault values in the rotated client secret API endpoint.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-17048"
},
{
"category": "external",
"summary": "RHBZ#2506743",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506743"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-17048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-17048"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-17048",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17048"
}
],
"release_date": "2026-07-21T10:47:21+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:44:39+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API"
},
{
"acknowledgments": [
{
"names": [
"James Paremain"
]
}
],
"cve": "CVE-2026-18963",
"cwe": {
"id": "CWE-640",
"name": "Weak Password Recovery Mechanism for Forgotten Password"
},
"discovery_date": "2026-07-31T15:46:15+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511595"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Critical, given that it can be exploited by an unauthenticated remote attacker without any user interaction. Successful exploitation allows an attacker to gain full access to any user account by bypassing the email verification step in the password recovery process. The vulnerability\u0027s root cause is improper state validation within the reset-credentials authentication flow.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18963"
},
{
"category": "external",
"summary": "RHBZ#2511595",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18963"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963"
}
],
"release_date": "2026-08-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T20:44:39+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
},
{
"category": "workaround",
"details": "If an immediate upgrade is not possible, disabling the \"Forgot password\" functionality across all realms can be used as a temporary mitigation.\n\nIn the RHBK administration console, navigate to:\n\nRealm settings \u2192 Login \u2192 Forgot password \u2192 Off\n\nApply this setting to all realms.\n\nUpgrade to a fixed version as soon as possible.",
"product_ids": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le",
"9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…