Vulnerability-Lookup

RHSA-2026:56519

Vulnerability from csaf_redhat - Published: 2026-08-18 20:49 - Updated: 2026-08-19 03:21

Summary

Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Images Security Update

Severity

Critical

Notes

Topic: New images are available for Red Hat build of Keycloak 26.4.15 and Red Hat build of Keycloak 26.4.15 Operator, running on OpenShift Container Platform

Details: Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.4.15 clusters. This erratum releases new images for Red Hat build of Keycloak 26.4.15 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release. Security fixes: * Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64	—	Vendor Fix fix Workaround

Threats

Impact Critical

References

7 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:56519	self
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-18963	self
https://bugzilla.redhat.com/show_bug.cgi?id=2511595	external
https://www.cve.org/CVERecord?id=CVE-2026-18963	external
https://nvd.nist.gov/vuln/detail/CVE-2026-18963	external

Acknowledgments

James Paremain

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New images are available for Red Hat build of Keycloak 26.4.15 and Red Hat build of Keycloak 26.4.15 Operator, running on OpenShift Container Platform",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak is an integrated sign-on solution,\navailable as a Red Hat JBoss Middleware for OpenShift containerized\nimage. The Red Hat build of Keycloak for OpenShift image provides\nan authentication server that you can use to log in centrally, log\nout, and register. You can also manage user accounts for web\napplications, mobile applications, and RESTful web services.\n\nRed Hat build of Keycloak Operator for OpenShift simplifies\ndeployment and management of Keycloak 26.4.15 clusters.\n\nThis erratum releases new images for Red Hat build of Keycloak\n26.4.15 for use within the OpenShift Container Platform cloud\ncomputing Platform-as-a-Service (PaaS) for on-premise or private\ncloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:56519",
        "url": "https://access.redhat.com/errata/RHSA-2026:56519"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56519.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Images Security Update",
    "tracking": {
      "current_release_date": "2026-08-19T03:21:22+00:00",
      "generator": {
        "date": "2026-08-19T03:21:22+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:56519",
      "initial_release_date": "2026-08-18T20:49:21+00:00",
      "revision_history": [
        {
          "date": "2026-08-18T20:49:21+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-18T20:49:21+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-19T03:21:22+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 26.4",
                "product": {
                  "name": "Red Hat build of Keycloak 26.4",
                  "product_id": "9Base-RHBK-26.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:26.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-23"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-23"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-23"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
                "product": {
                  "name": "rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
                  "product_id": "rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=26.4.15-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-23"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-23"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-23"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
                  "product_id": "rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.4-23"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.4-23"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64"
        },
        "product_reference": "rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64 as a component of Red Hat build of Keycloak 26.4",
          "product_id": "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64",
        "relates_to_product_reference": "9Base-RHBK-26.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "James Paremain"
          ]
        }
      ],
      "cve": "CVE-2026-18963",
      "cwe": {
        "id": "CWE-640",
        "name": "Weak Password Recovery Mechanism for Forgotten Password"
      },
      "discovery_date": "2026-07-31T15:46:15+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2511595"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Critical, given that it can be exploited by an unauthenticated remote attacker without any user interaction. Successful exploitation allows an attacker to gain full access to any user account by bypassing the email verification step in the password recovery process. The vulnerability\u0027s root cause is improper state validation within the reset-credentials authentication flow.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
          "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18963"
        },
        {
          "category": "external",
          "summary": "RHBZ#2511595",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18963",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18963"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963"
        }
      ],
      "release_date": "2026-08-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T20:49:21+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56519"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.4:rhbk/keycloak-operator-bundle@sha256:f4df815564fc6801b50dffbbd3e0a421dfd83841c83c22a8e09305eeffdaf687_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:32c3da0c9e63f7a86ae49255fbcf318406bb3e34ee07f1bae7e1dc01c6329efd_arm64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:9b5001e9dde3cd87823988cafd809a5887b296c048e398171e28b1c256de1107_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b72782f1fbc44144e58f08884b5a6f9a3a49e32c1965a9ce3d01bd6f70e761f8_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9-operator@sha256:b80c873fd9fe1ec85cf4191714a6ea2ac80854b2bdc3781d15811d16692527a0_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:5ae22f5c60ebeab633caa0ac3e3540402e9d589409513c67c2b1dada998c178d_ppc64le",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:696cf024e6bb736260b7a2439cc9e7b3aa05024c8c493ae6e448b224718e464b_amd64",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:8918c47378bb686b0894188d6ad578e5ce469def4926c419194703237a2fee3d_s390x",
            "9Base-RHBK-26.4:rhbk/keycloak-rhel9@sha256:faf3f6772c31b33f526887927505095a6dd5bd8e507c643ebcc64eea60be56eb_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass"
    }
  ]
}

CVE-2026-18963 (GCVE-0-2026-18963)

Vulnerability from cvelistv5 – Published: 2026-08-18 17:05 – Updated: 2026-08-19 01:55

Title

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

Summary

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:56519	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56520	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56523	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56524	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-18963	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511595	issue-trackingx_refsource_REDHAT

Impacted products

8 products

Vendor	Product	Version
Red Hat	Red Hat build of Keycloak 26.4	Unaffected: 26.4.15-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.4::el9
Red Hat	Red Hat build of Keycloak 26.4	Unaffected: 26.4-23 , < * (rpm) cpe:/a:redhat:build_keycloak:26.4::el9
Red Hat	Red Hat build of Keycloak 26.4.15	cpe:/a:redhat:build_keycloak:26.4
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6.6-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6-12 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6.6	cpe:/a:redhat:build_keycloak:26.6
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7

Date Public

2026-08-17 00:00

Credits

Red Hat would like to thank James Paremain for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4.15-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-23",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-23",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat build of Keycloak 26.4.15",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
          "product": "Red Hat build of Keycloak 26.4.15",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6.6-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-12",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-12",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat build of Keycloak 26.6.6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6.6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
          "product": "Red Hat build of Keycloak 26.6.6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "defaultStatus": "affected",
          "packageName": "keycloak-services",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank James Paremain for reporting this issue."
        }
      ],
      "datePublic": "2026-08-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Critical"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T01:55:47.339Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:56519",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56519"
        },
        {
          "name": "RHSA-2026:56520",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56520"
        },
        {
          "name": "RHSA-2026:56523",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56523"
        },
        {
          "name": "RHSA-2026:56524",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56524"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-18963"
        },
        {
          "name": "RHBZ#2511595",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-31T15:46:15.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-08-17T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-18963",
    "datePublished": "2026-08-18T17:05:07.478Z",
    "dateReserved": "2026-08-05T15:00:40.360Z",
    "dateUpdated": "2026-08-19T01:55:47.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:56519

CVE-2026-18963 (GCVE-0-2026-18963)

Tags

Sightings

Nomenclature