CVE-2026-18963: Red Hat build of Keycloak 26.4 (exact versions not specified); +9 more affected products

Affected technology

Red Hat build of Keycloak 26.4 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Keycloak 26.4.15 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Keycloak 26.6 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Keycloak 26.6.6 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform Expansion Pack · Exact affected versions not specified by the source
Red Hat

Red Hat Single Sign-On 7 · Exact affected versions not specified by the source
Red Hat

Industrial Edge Management Cloud · 0 to before *
Siemens

Industrial Edge Management Pro V1 · V1.14.9 to before V1.15.20
Siemens

Industrial Edge Management Pro V2 · V2.2.0 to before V2.2.2
Siemens

Industrial Edge Management Virtual · V2.6.0 to before V2.9.1
Siemens

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can force the password reset process for any user without needing to click the required email verification link. Vendor/CNA’s CVSS 3.1 assessment (base score 9.1/10) rates confidentiality and integrity impact as high; availability impact as none.