Vulnerability report

Active exploitation observed Confirmed confidence Not in CISA KEV

CVE-2026-18963

Red Hat build of Keycloak 26.4

Red Hat / Red Hat build of Keycloak 26.4 · affected before *

View live feed Monitor via API Watch CVE-2026-18963
Severity
CVSS 9.1 · Critical
Confidence
Confirmed
Exploit status
Observed in sensors
EPSS
3.2%
First observed
25 Aug 2026
Last observed
25 Aug 2026

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-18963 is an unauthenticated vulnerability affecting Red Hat Red Hat build of Keycloak 26.4 and 5 other products. A flaw was found in the reset-credentials flow of the keycloak-services component, which is the...

Is it exploited?

Yes. Previdian sensors observed exploitation attempts with confirmed confidence.

Who is affected?

Red Hat / Red Hat build of Keycloak 26.4 affected before *.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

Red Hat build of Keycloak 26.4

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link.

This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Siemens Affected
Industrial Edge Management Cloud
Before *
Siemens Affected
Industrial Edge Management Pro V1
Before V1.15.20
Siemens Affected
Industrial Edge Management Pro V2
Before V2.2.2
Siemens Affected
Industrial Edge Management Virtual
Before V2.9.1
Red Hat Unaffected
Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9-operator
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.4.15 keycloak-services
All versions (default: unaffected)
Red Hat Unaffected
Red Hat build of Keycloak 26.4.15 rhbk-openshift-rhel9/rhbk-openshift-rhel9
All versions (default: unaffected)
Red Hat Unaffected
Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9-operator
Before *
Red Hat Unaffected
Red Hat build of Keycloak 26.6.6 keycloak-services
All versions (default: unaffected)
Red Hat Unaffected
Red Hat build of Keycloak 26.6.6 rhbk-keycloak-rhel9/rhbk-keycloak-rhel9
All versions (default: unaffected)
Red Hat Unaffected
Red Hat build of Keycloak 26.6.6 rhbk-openshift-rhel9/rhbk-openshift-rhel9
All versions (default: unaffected)
Red Hat Unaffected
Red Hat JBoss Enterprise Application Platform Expansion Pack keycloak-services
All versions (default: unaffected)
Red Hat Unaffected
Red Hat Single Sign-On 7 keycloak-services
All versions (default: unaffected)
View vendor advisory (opens in new tab)
Published
18 Aug 2026
Exploitation Reported
25 Aug 2026
Attack vector
Remote
Complexity
Low
Privileges
None
User interaction
None

Tags

nuclei_scanner

CVE References

  • CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-18963
  • RHSA-2026:56519 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2026:56519
  • RHSA-2026:56520 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2026:56520
  • RHSA-2026:56523 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2026:56523
  • RHSA-2026:56524 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2026:56524
  • RHBZ#2511595 bugzilla.redhat.com · Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2511595
  • VDB Entry — access.redhat.com access.redhat.com · VDB Entry https://access.redhat.com/security/cve/CVE-2026-18963

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

Previdian

Recorded 25 Aug 2026

Previdian independently recorded this as exploited after first seeing it in honeypot sensors.

Active exploitation observed

Previdian sensor

First observed 25 Aug 2026

Previdian first observed exploitation attempts targeting this vulnerability in our honeypot sensors.

Proof of concept available

GitHub

Recorded 20 Aug 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
Previdian First 2026-08-25 15:13 UTC

Operational indicators for this CVE are listed under Detection.

Sensor telemetry

First-party evidence of exploitation activity

Previdian sensors recorded exploitation attempts targeting this vulnerability. The cards and chart show volume, unique attackers, and daily activity.

32

Attempts observed

1

Unique attacker IPs

1

Attacker countries

US

1

Sensors observed

CVE-2026-18963 exploitation attempts over the last 23 days

Daily events observed by Previdian sensors

Updated 15 Sep 2026

0
32
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
24 Aug 29 Aug 3 Sep 8 Sep 15 Sep

First observed 25 Aug 2026 · Last observed 25 Aug 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Request telemetry access

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts
32
1
0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Attacker IP Indicators

Attacker IP indicators observed · available in Pro and Enterprise.

Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.

Learn about Pro API access

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner Reference Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18963.yaml 25 Aug 2026

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

3.2%

Weaknesses

Weak Password Recovery Mechanism for Forgotten Password CWE-640

Recent mention · TheHackerNews

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The...

Read full advisory

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

0xlyvio/CVE-2026-18963-keycloak

github · Created 2026-09-05 20:52:28 UTC · 0 stars · AI assessment 90%

CVE-2026-18963 — Keycloak reset-credentials bypass -> Account Takeover

EQSTLab/CVE-2026-18963

github · Created 2026-09-01 09:08:39 UTC · 0 stars · AI assessment 90%

Unauthenticated account takeover via reset-credentials flow bypass

alt3kx/CVE-2026-18963

github · Created 2026-08-27 09:08:05 UTC · 0 stars · AI assessment 85%

CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detector

gman0x00/keycloak-CVE-2026-18963

github · Created 2026-08-25 15:05:11 UTC · 0 stars · AI assessment 90%

PoC, Dockerfile playground and root cause from patch diff analysis.

CVE-2026-18963: Keycloak - Auth Bypass

1dayexploit · Created 2026-08-25 08:30:00 UTC

CVE-2026-18963: Keycloak unauthenticated account takeover via reset-credentials flow - attacker sets arbitrary password without email verification, CVSS 9.1 critical.

BlackHatExploitation/Exploit-For-CVE-2026-18963

github · Created 2026-08-25 05:39:39 UTC · 0 stars · AI assessment 90%

Exploit for CVE-2026-18963 by BlackHatExploitation

prot0tw/CVE-2026-18963

github · Created 2026-08-25 02:28:04 UTC · 0 stars · AI assessment 90%

prot0tw/Keycloak_CVE-2026-18963_PoC

github · Created 2026-08-25 02:28:04 UTC · 7 stars · AI assessment 90%

This repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).

Red-Darkin/CVE-2026-18963-keycloak

github · Created 2026-08-24 23:40:17 UTC · 2 stars · AI assessment 90%

T0w0T/POC-CVE-2026-18963

github · Created 2026-08-24 13:00:27 UTC · 0 stars · AI assessment 90%

Keycloak reset-credentials flow: unauthenticated account takeover (CWE-640)

pruva · Created 2026-08-24 11:14:39 UTC

Severity: CRITICAL | CVE: CVE-2026-18963 | Package: org.keycloak:keycloak-services (Maven)

minh3102011/CVE-2026-18963_analyst

github · Created 2026-08-24 08:49:49 UTC · 0 stars · AI assessment 85%

Snizi/CVE-2026-18963-Exploit

github · Created 2026-08-20 22:01:11 UTC · 0 stars · AI assessment 90%

Exploit for KeyCloak CVE-2026-18963

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

nuclei · Created Unknown

Timeline

From disclosure to observed exploitation

  1. 14:58 UTC

    Indicator of compromise added

    Indicators of compromise recorded

  2. 14:58 UTC

    Observed by Previdian sensors

    Evidence-backed exploitation signal

  3. 04:31 UTC

    Nuclei template available

    Scanner coverage available

  4. 22:01 UTC

    Public PoC available

    Public proof-of-concept code published

  5. 18:20 UTC

    Added to the Previdian watchlist

    Pro and Enterprise Watch users had 1 week of early warning before Previdian confirmed it as a KEV.

  6. 17:05 UTC

    CVE published

    Vulnerability disclosed publicly

  7. 15:00 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-18963

Free JSON includes basic KEV fields 
{
  "cve_id": "CVE-2026-18963",
  "confidence": "Confirmed",
  "cvss_score": 9.1,
  "cvss_estimated": false,
  "epss_score": 0.03177,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "attempts": 32, "sensors": 1 }
}