Red Hat Single Sign-On 7.6.13 vulnerabilities

2 CVEs affecting Red Hat Single Sign-On 7.6.13, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15563, published 2026-08-11.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-0603, published 2026-01-23. High severity, CVSS 8.3. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters…
• CVE-2026-15563, published 2026-08-11. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB,…