How to fix CVE-2026-18963: CVE-2026-18963 (public exploit)

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

• Severity: CRITICAL (CVSS 3.1 9.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
• Weakness: CWE-640.
• NVD published 2026-08-18, status Awaiting Analysis.

Anyone running CVE-2026-18963. If the service is reachable from the internet, treat it as the priority.

NVD has not published affected version ranges for this CVE yet. Use the vendor advisory in the sources below to confirm which builds are affected.

• Exploit-DB: EDB-52699 Keycloak 26.7.2 - Unauthenticated Account Takeover (2026-10-21).
• Public proof-of-concept code: 18 GitHub repositories from 18 accounts, the first on 2026-08-20.

• EPSS (probability of exploitation activity in the next 30 days): 6.41%, higher than 94% of all scored CVEs (as of 2026-10-24).
• CVERadar threat level: 54/100 (see methodology).
• Likely ATT&CK techniques: T1190 Exploit Public-Facing Application (inferred).

1. Find every instance. List where CVE-2026-18963 runs, including test, DR and forgotten internet-facing systems, and record the installed version.
2. Apply the latest vendor update. NVD does not list a fixed version, so follow the vendor advisory for the patched release.
3. If you can't patch today, apply the vendor's workaround from the advisory, and take the service off the internet or restrict it to a VPN or allow-list until it is patched.
4. Verify the fix. Re-run the version check on every instance and confirm it reports the fixed build. Re-scan from outside if the service is exposed.
5. Hunt for signs of earlier compromise. If the system was exposed before you patched, assume it may have been hit and check the items below.
6. Rotate credentials stored on or used by the affected system if you cannot rule out compromise, and keep the logs you reviewed.

Detection hints

• T1190 Exploit Public-Facing Application: Review WAF, reverse-proxy and application logs for unusual requests to the affected service (odd paths, oversized or encoded payloads, bursts of errors), going back to at least 2026-08-18.

Detection commands are generic starting points, not CVE-specific signatures. Use the indicators from the vendor advisory when it publishes them.

• NVD: CVE-2026-18963 nvd.nist.gov/vuln/detail/CVE-2026-18963
• CVE.org record www.cve.org/CVERecord?id=CVE-2026-18963
• FIRST EPSS (2026-10-24) api.first.org/data/v1/epss?cve=CVE-2026-18963