Vulnerability report

Exploitation attempts observed Confirmed confidence Not in CISA KEV

CVE-2026-18963

Red Hat build of Keycloak 26.4

Red Hat build of Keycloak 26.4 · affected before *

Watch CVE-2026-18963 Browse KEV feed
Severity
CVSS 9.1 · Critical
Confidence
Confirmed
Exploit status
Observed in sensors
EPSS
4.7%
First observed
25 Aug 2026
Last observed
18 Sep 2026

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-18963 is an unauthenticated vulnerability affecting Red Hat build of Keycloak 26.4 and 5 other products. A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core...

Have exploitation attempts been observed?

Yes. Previdian sensors have observed 33 exploitation attempts, 2 unique attacker IPs, and 2 countries targeting CVE-2026-18963. First observed Aug 25, 2026; last observed Sep 18, 2026. Confidence is confirmed.

Who is affected?

Red Hat build of Keycloak 26.4 affected before *.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

Red Hat build of Keycloak 26.4

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link.

This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Siemens Affected
Industrial Edge Management Cloud
Before *
Siemens Affected
Industrial Edge Management Pro V1
Before V1.15.20
Siemens Affected
Industrial Edge Management Pro V2
Before V2.2.2
Siemens Affected
Industrial Edge Management Virtual
Before V2.9.1
Red Hat Unaffected
Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9-operator
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.4.15 keycloak-services
All versions (default: unaffected)
Red Hat Unaffected
Red Hat build of Keycloak 26.4.15 rhbk-openshift-rhel9/rhbk-openshift-rhel9
All versions (default: unaffected)
Red Hat Unaffected
Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9-operator
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.6.6 keycloak-services
All versions (default: unaffected)
Red Hat Unaffected
Red Hat build of Keycloak 26.6.6 rhbk-keycloak-rhel9/rhbk-keycloak-rhel9
All versions (default: unaffected)
Red Hat Unaffected
Red Hat build of Keycloak 26.6.6 rhbk-openshift-rhel9/rhbk-openshift-rhel9
All versions (default: unaffected)
Red Hat Unaffected
Red Hat JBoss Enterprise Application Platform Expansion Pack keycloak-services
All versions (default: unaffected)
Red Hat Affected
Red Hat Single Sign-On 7 keycloak-services
All versions (default: affected)
View vendor advisory (opens in new tab)
Published
18 Aug 2026
Exploitation Attempts Reported
25 Aug 2026
Attack vector
Remote
Complexity
Low
Privileges
None
User interaction
None

Tags

nuclei_scanner

CVE References

  • CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-18963
  • RHSA-2026:56519 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2026:56519
  • RHSA-2026:56520 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2026:56520
  • RHSA-2026:56523 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2026:56523
  • RHSA-2026:56524 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2026:56524
  • RHBZ#2511595 bugzilla.redhat.com · Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2511595
  • VDB Entry — access.redhat.com access.redhat.com · VDB Entry https://access.redhat.com/security/cve/CVE-2026-18963

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation attempts observed in the wild

Previdian

Recorded 25 Aug 2026

Previdian sensors observed exploitation attempts targeting this vulnerability.

Exploitation attempts observed

Previdian sensor

First observed 25 Aug 2026

Previdian sensors observed exploitation attempts targeting this vulnerability.

Proof of concept available

GitHub

Recorded 20 Aug 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
Previdian Sensors First 2026-08-25 15:13 UTC

Operational indicators for this CVE are listed under Detection.

Sensor telemetry

Previdian Sensor Observations

Previdian sensor observations are exploitation attempts targeting this vulnerability. They do not show that the target was vulnerable or that the attempt succeeded. The cards and chart show volume, unique attackers, and daily activity.

33

Attempts observed

2

Unique attacker IPs

2

Attacker countries

GB · US

1

Sensors observed

CVE-2026-18963 exploitation attempts over the last 65 days

Daily events observed by Previdian sensors

Updated 27 Oct 2026

0
32
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
24 Aug 6 Sep 19 Sep 2 Oct 27 Oct

First observed 25 Aug 2026 · Last observed 18 Sep 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Start 14-day Pro trial

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Attacker IP Indicators

Attacker IP indicators observed · available in Pro and Enterprise.

Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.

Learn about Pro API access

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner Reference Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18963.yaml 25 Aug 2026

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

9.1 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

4.7%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Weak Password Recovery Mechanism for Forgotten Password CWE-640

Recent mention · ExploitDB

[webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover

Keycloak 26.7.2 - Unauthenticated Account Takeover

Read full advisory

All Mentions

Recent mention · ExploitDB

[webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover

ExploitDB · 21 Oct 2026

Keycloak 26.7.2 - Unauthenticated Account Takeover

Recent mention · The Hacker News

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

The Hacker News · 24 Aug 2026

Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

orevim/CVE-2026-18963-PoC

github · Created 2026-10-15 11:12:41 UTC · 0 stars · AI assessment 84%

Proof of concept and vulnerability checker for CVE-2026-18963, the Keycloak reset-credentials flow bypass

hardeep-sudo/Keycloak-CVE-2026-18963-Exploit

github · Created 2026-10-08 09:25:45 UTC · 0 stars · AI assessment 90%

SonOfABot/-CVE-2026-18963-POC

github · Created 2026-10-08 08:50:26 UTC · 0 stars · AI assessment 90%

PoC for keycloak 1.26 vulnerability

0xlyvio/CVE-2026-18963-keycloak

github · Created 2026-09-05 20:52:28 UTC · 0 stars · AI assessment 90%

CVE-2026-18963 — Keycloak reset-credentials bypass -> Account Takeover

EQSTLab/CVE-2026-18963

github · Created 2026-09-01 09:08:39 UTC · 0 stars · AI assessment 90%

Unauthenticated account takeover via reset-credentials flow bypass

alt3kx/CVE-2026-18963

github · Created 2026-08-27 09:08:05 UTC · 0 stars · AI assessment 85%

CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detector

gman0x00/keycloak-CVE-2026-18963

github · Created 2026-08-25 15:05:11 UTC · 0 stars · AI assessment 90%

PoC, Dockerfile playground and root cause from patch diff analysis.

CVE-2026-18963: Keycloak - Auth Bypass

1dayexploit · Created 2026-08-25 08:30:00 UTC

CVE-2026-18963: Keycloak unauthenticated account takeover via reset-credentials flow - attacker sets arbitrary password without email verification, CVSS 9.1 critical.

BlackHatExploitation/Exploit-For-CVE-2026-18963

github · Created 2026-08-25 05:39:39 UTC · 0 stars · AI assessment 90%

Exploit for CVE-2026-18963 by BlackHatExploitation

prot0tw/Keycloak_CVE-2026-18963_PoC

github · Created 2026-08-25 02:28:04 UTC · 7 stars · AI assessment 90%

This repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).

Timeline

From disclosure to observed exploitation attempts

  1. 14:58 UTC

    Indicators of compromise added (2)

    Indicators of compromise recorded

  2. 14:58 UTC

    Observed by Previdian sensors

    Previdian sensors observed exploitation attempts targeting this vulnerability.

  3. 04:31 UTC

    Nuclei template available

    Scanner coverage available

  4. 22:01 UTC

    Public PoC available

    Public proof-of-concept code published

  5. 18:20 UTC

    Added to the Previdian watchlist

    Pro and Enterprise Watch users had 1 week of early warning before Previdian confirmed it as a KEV.

  6. 17:05 UTC

    CVE published

    Vulnerability disclosed publicly

  7. 15:00 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-18963

Sample API response 
{
  "cve_id": "CVE-2026-18963",
  "confidence": "Confirmed",
  "cvss_score": 9.1,
  "cvss_estimated": false,
  "epss_score": 0.04682,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "attempts": 33, "sensors": 1 }
}