Red Hat Build Of Keycloak 26.6.6 vulnerabilities

2 CVEs affecting Red Hat Build Of Keycloak 26.6.6, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15571, published 2026-08-18.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-18963, published 2026-08-18. Critical severity, CVSS 9.1. EPSS: 3.2% chance of exploitation in the next 30 days. A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an…
• CVE-2026-15571, published 2026-08-18. High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the…