Vulnerability-Lookup

4JDE002044

Vulnerability from csaf_abb - Published: 2026-09-17 00:30 - Updated: 2026-09-17 00:30

Summary

dynovaPRO™ Reset Credentials Vulnerability

Notes

Summary: ABB is aware of public reports of a vulnerability in the product listed as affected in the advisory. An update has been deployed to the cloud system that resolves a publicly reported vulnerability in the product versions listed above. An attacker who successfully exploited this vulnerability could take remote control of the product. The vulnerability has been identified in the keycloak authentication component which is integrated into dynovaPRO™. The vulnerability exists in the 'Forgot Password' functionality and allows unauthenticated attackers to bypass authentication and hijack user accounts. Users who have received a password reset mail before the mentioned date, without having requested it, are thereby potentially attacked by exploiting this vulnerability. ABB investigated potentially malicious user reset activities and blocked those user access immediately to reduce the exploitation risk. The credentials of those users have been deleted after the software fix was deployed and the users were informed that they must reset their password to gain access to dynovaPRO™ again.

Support: For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters. Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Notice: The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.

General security recommendations: For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices: – Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks). – Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks. – Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for. – Scan all data imported into your environment before use to detect potential malware infections. – Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless designed for such exposure and business requirements dictate it. – Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such. – Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

Purpose: ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security. When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations. The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication. The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Frequently Asked Questions: What causes the vulnerability? - The vulnerability is caused by improper token validation in the Keycloak password recovery mechanism, allowing attackers to bypass email verification and reset user credentials without proper authentication. Which components are affected? - Keycloak authentication component integrated into dynovaPRO™ is affected. What might an attacker use the vulnerability to do? - An attacker can take over user accounts by resetting credentials, gaining unauthorized access to personal and operational data, modifying system configurations, and potentially causing service disruptions, depending on the user’s privileges. How could an attacker exploit the vulnerability? - An attacker sends crafted HTTP requests to the password reset endpoint with manipulated session parameters, bypassing normal authentication and email verification. Only the user's email address is required. Could the vulnerability be exploited remotely? - Yes, an attacker with network access to dynovaPRO™ can exploit this vulnerability remotely without any special conditions or physical access requirements. Can functional safety be affected by an exploit of this vulnerability? - While functional safety systems are separate from user account management, compromise of adminis-trative accounts could enable unauthorized control commands affecting operational devices such as chargers, batteries, and PV systems. What does the update do? - The update corrects the Keycloak token validation mechanism in the password reset flow, ensuring proper authentication and email verification before allowing credential changes. When this security advisory was issued, had this vulnerability been publicly disclosed? - Yes, CVE-2026-18963 has been publicly disclosed at 17/08/2026 and is documented in the National Vulnerability Database (NVD). When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - As of August 27, 2026, ABB had not received confirmed reports of active exploitation in the wild. Internal log analysis identified 26 password change events affecting 9 customers, which may indicate testing or reconnaissance activity. Those users have been disabled and forced to reset their password after the software vulnerability fix has been deployed.

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C/CR:M/IR:M/AR:L/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:L/MI:L/MA:N

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
ABB dynovaPRO™ cloud system >= 2026-08-27 12:00 (CEST) ABB		—

Known affected 1 product

Product	Identifier	Version	Remediation
ABB dynovaPRO™ cloud system < 2026-08-27 12:00 (CEST) ABB		—	Mitigation Workaround Vendor Fix

References

3 references

URL	Category
https://search.abb.com/library/Download.aspx?Docu…	self
https://psirt.abb.com/csaf/2026/4jde002044.json	self
https://nvd.nist.gov/vuln/detail/CVE-2026-18963	external

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "ABB is aware of public reports of a vulnerability in the product listed as affected in the advisory. An update has been deployed to the cloud system that resolves a publicly reported vulnerability in the product versions listed above.\n\nAn attacker who successfully exploited this vulnerability could take remote control of the product.\n\nThe vulnerability has been identified in the keycloak authentication component which is integrated into dynovaPRO\u2122. The vulnerability exists in the \u0027Forgot Password\u0027 functionality and allows unauthenticated attackers to bypass authentication and hijack user accounts.\n\nUsers who have received a password reset mail before the mentioned date, without having requested it, are thereby potentially attacked by exploiting this vulnerability. \n\nABB investigated potentially malicious user reset activities and blocked those user access immediately to reduce the exploitation risk. The credentials of those users have been deleted after the software fix was deployed and the users were informed that they must reset their password to gain access to dynovaPRO\u2122 again.\n",
        "title": "Summary"
      },
      {
        "category": "other",
        "text": "For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.\n\nInformation about ABB\u2019s cyber security program and capabilities can be found at www.abb.com/cybersecurity.",
        "title": "Support"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.\n\nABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.\n\nThis document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.\n\nAll rights to registrations and trademarks reside with their respective owners.\n",
        "title": "Notice"
      },
      {
        "category": "other",
        "text": "For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:\n\n\u2013\tIsolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).\n\n\u2013\tInstall physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.\n\n\u2013\tNever connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.\n\n\u2013\tScan all data imported into your environment before use to detect potential malware infections.\n\n\u2013\tMinimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless designed for such exposure and business requirements dictate it.\n\n\u2013\tMinimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.\n\n\u2013\tEnsure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.\n\n",
        "title": "General security recommendations"
      },
      {
        "category": "other",
        "text": "ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.\n\nWhen a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.\n\nThe resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.\n\nThe publication of this Cyber Security Advisory is an example of ABB\u2019s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.",
        "title": "Purpose"
      },
      {
        "category": "faq",
        "text": "What causes the vulnerability?\n- The vulnerability is caused by improper token validation in the Keycloak password recovery mechanism, allowing attackers to bypass email verification and reset user credentials without proper authentication.\n\nWhich components are affected?\n- Keycloak authentication component integrated into dynovaPRO\u2122 is affected. \n\nWhat might an attacker use the vulnerability to do?\n- An attacker can take over user accounts by resetting credentials, gaining unauthorized access to personal and operational data, modifying system configurations, and potentially causing service disruptions, depending on the user\u2019s privileges.\n\nHow could an attacker exploit the vulnerability?\n- An attacker sends crafted HTTP requests to the password reset endpoint with manipulated session parameters, bypassing normal authentication and email verification. Only the user\u0027s email address is required.\n\nCould the vulnerability be exploited remotely? \n- Yes, an attacker with network access to dynovaPRO\u2122 can exploit this vulnerability remotely without any special conditions or physical access requirements.\n\nCan functional safety be affected by an exploit of this vulnerability?\n- While functional safety systems are separate from user account management, compromise of adminis-trative accounts could enable unauthorized control commands affecting operational devices such as chargers, batteries, and PV systems.\n\nWhat does the update do?\n- The update corrects the Keycloak token validation mechanism in the password reset flow, ensuring proper authentication and email verification before allowing credential changes.\n\nWhen this security advisory was issued, had this vulnerability been publicly disclosed?\n- Yes, CVE-2026-18963 has been publicly disclosed at 17/08/2026 and is documented in the National Vulnerability Database (NVD).\n\nWhen this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?\n- As of August 27, 2026, ABB had not received confirmed reports of active exploitation in the wild. Internal log analysis identified 26 password change events affecting 9 customers, which may indicate testing or reconnaissance activity. Those users have been disabled and forced to reset their password after the software vulnerability fix has been deployed.\n\n",
        "title": "Frequently Asked Questions"
      }
    ],
    "publisher": {
      "category": "vendor",
      "name": "ABB PSIRT",
      "namespace": "https://www.abb.com/global/en/company/about/cybersecurity/alerts-and-notifications"
    },
    "references": [
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - PDF Version ",
        "url": "https://search.abb.com/library/Download.aspx?DocumentID=4JDE002044\u0026LanguageCode=en\u0026DocumentPartId=pdf\u0026Action=Launch"
      },
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - CSAF Version ",
        "url": "https://psirt.abb.com/csaf/2026/4jde002044.json"
      }
    ],
    "title": "dynovaPRO\u2122 Reset Credentials Vulnerability",
    "tracking": {
      "current_release_date": "2026-09-17T00:30:00.000Z",
      "generator": {
        "date": "2026-09-17T10:19:02.441Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.12"
        }
      },
      "id": "4JDE002044",
      "initial_release_date": "2026-09-17T00:30:00.000Z",
      "revision_history": [
        {
          "date": "2026-09-17T00:30:00.000Z",
          "legacy_version": "A",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "dynovaPRO\u2122 cloud system \u003c 2026-08-27 12:00 (CEST)",
            "product": {
              "name": "ABB dynovaPRO\u2122 cloud system \u003c 2026-08-27 12:00 (CEST)",
              "product_id": "AV1"
            }
          },
          {
            "category": "product_name",
            "name": "dynovaPRO\u2122 cloud system \u003e= 2026-08-27 12:00 (CEST)",
            "product": {
              "name": "ABB dynovaPRO\u2122 cloud system \u003e= 2026-08-27 12:00 (CEST)",
              "product_id": "FX1"
            }
          }
        ],
        "category": "vendor",
        "name": "ABB"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-18963",
      "cwe": {
        "id": "CWE-640",
        "name": "Weak Password Recovery Mechanism for Forgotten Password"
      },
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2026-18963 ",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "The following conditions reduce the risk of exploitation of this vulnerability:\n\n-\tLimited Attack Surface: The vulnerability is specific to the password reset functionality. Other authentication methods are not affected.\n\n-\tEmail Notifications: Legitimate users receive email notifications during password reset attempts, which may alert them to unauthorized access attempts.\n\nRefer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "workaround",
          "details": "Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as \u201cImpact of workaround\u201d.\n\nABB has implemented temporary mitigation measures for customers:\n-\tPassword Reset Function disabled: The password reset functionality has been disabled for all dynovaPRO\u2122 customers to prevent exploitation of this vulnerability as a short term step, until software update has been carried out.\n-\tAccount Monitoring: Users are advised to monitor their user account activity for any unauthorized access.\n\nNote: These workarounds do not eliminate the underlying vulnerability until it has been fixed in dynovaPRO\u2122.\n",
          "product_ids": [
            "AV1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "The problem is corrected in the dynovaPRO\u2122 cloud system since 2026-08-27 12:00 (CEST).\n\nUsers who have received a password reset mail without their consent should reset their password to ensure an attacker did not gain access to their account.\n",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "LOW",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "MEDIUM",
            "environmentalScore": 6,
            "environmentalSeverity": "MEDIUM",
            "exploitCodeMaturity": "FUNCTIONAL",
            "integrityImpact": "HIGH",
            "integrityRequirement": "MEDIUM",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "NETWORK",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "LOW",
            "modifiedIntegrityImpact": "LOW",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 8.4,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C/CR:M/IR:M/AR:L/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:L/MI:L/MA:N",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2026-18963"
    }
  ]
}

CVE-2026-18963 (GCVE-0-2026-18963)

Vulnerability from cvelistv5 – Published: 2026-08-18 17:05 – Updated: 2026-09-08 08:44

Title

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

Summary

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 13:53 UTC

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

redhat redhat root

References

7 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:56519	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56520	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56523	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56524	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-18963	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511595	issue-trackingx_refsource_REDHAT
https://cert-portal.siemens.com/productcert/html/…

Impacted products

12 products

Vendor	Product	Version
Red Hat	Red Hat build of Keycloak 26.4	Unaffected: 26.4.15-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.4::el9
Red Hat	Red Hat build of Keycloak 26.4	Unaffected: 26.4-23 , < * (rpm) cpe:/a:redhat:build_keycloak:26.4::el9
Red Hat	Red Hat build of Keycloak 26.4.15	cpe:/a:redhat:build_keycloak:26.4
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6.6-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6-12 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6.6	cpe:/a:redhat:build_keycloak:26.6
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7
Siemens	Industrial Edge Management Cloud	Affected: 0 , < * (custom)
Siemens	Industrial Edge Management Pro V1	Affected: V1.14.9 , < V1.15.20 (custom)
Siemens	Industrial Edge Management Pro V2	Affected: V2.2.0 , < V2.2.2 (custom)
Siemens	Industrial Edge Management Virtual	Affected: V2.6.0 , < V2.9.1 (custom)

Date Public

2026-08-17 00:00

Credits

Red Hat would like to thank James Paremain for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18963",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T13:53:38.227092Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T13:53:45.840Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Management Cloud",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Management Pro V1",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.15.20",
                "status": "affected",
                "version": "V1.14.9",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Management Pro V2",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.2.2",
                "status": "affected",
                "version": "V2.2.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Management Virtual",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.9.1",
                "status": "affected",
                "version": "V2.6.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:44:23.776Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-503852.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4.15-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-23",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-23",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat build of Keycloak 26.4.15",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
          "product": "Red Hat build of Keycloak 26.4.15",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6.6-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-12",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-12",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat build of Keycloak 26.6.6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6.6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
          "product": "Red Hat build of Keycloak 26.6.6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank James Paremain for reporting this issue."
        }
      ],
      "datePublic": "2026-08-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Critical"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T22:25:58.686Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:56519",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56519"
        },
        {
          "name": "RHSA-2026:56520",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56520"
        },
        {
          "name": "RHSA-2026:56523",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56523"
        },
        {
          "name": "RHSA-2026:56524",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56524"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-18963"
        },
        {
          "name": "RHBZ#2511595",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-31T15:46:15.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-08-17T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass",
      "workarounds": [
        {
          "lang": "en",
          "value": "If an immediate upgrade is not possible, disabling the \"Forgot password\" functionality across all realms can be used as a temporary mitigation.\n\nIn the RHBK administration console, navigate to:\n\nRealm settings \u2192 Login \u2192 Forgot password \u2192 Off\n\nApply this setting to all realms.\n\nUpgrade to a fixed version as soon as possible."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-18963",
    "datePublished": "2026-08-18T17:05:07.478Z",
    "dateReserved": "2026-08-05T15:00:40.360Z",
    "dateUpdated": "2026-09-08T08:44:23.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.