{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T20:45:43.249Z", "tag": { "id": "red-hat", "label": "Red Hat", "isStack": false, "url": "https://pwn.watch/t/red-hat", "feed": "https://pwn.watch/t/red-hat/feed.xml" }, "counts": { "incidents": 2, "live": 1, "notFullyPatched": 0, "patched": 2 }, "incidents": [ { "slug": "keycloak-cve-2026-18963-reset-credentials-takeover", "title": "Keycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963)", "url": "https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover", "json": "https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "Keycloak / Red Hat Build of Keycloak (keycloak-services)", "tags": [ "java", "keycloak", "red-hat", "account-takeover", "auth-bypass", "public-exploit" ], "cveIds": [ "CVE-2026-18963" ], "affectedVersions": [ "org.keycloak:keycloak-services >= 26.0.0, < 26.4.15", ">= 26.5.0, < 26.6.6", ">= 26.7.0, < 26.7.2" ], "fixedVersions": [ "26.4.15", "26.6.6", "26.7.2", "26.8.0 and later" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T22:40:44+02:00", "summary": "A flaw in Keycloak's reset-credentials flow (keycloak-services) lets an unauthenticated attacker force a password reset for any user without clicking the emailed verification link, then set new credentials and take over the account. Red Hat rates it CVSS 9.1. Fixes shipped in August (26.4.15, 26.6.6, 26.7.2); on Oct 21 a full proof-of-concept with check and takeover modes was published on Exploit-DB, so unpatched Keycloak instances should be upgraded now.", "xPost": { "id": "2113371062125904133", "postedAt": "2026-10-22T20:45:00.716Z", "url": "https://x.com/pwnwatch_app/status/2113371062125904133" } }, { "slug": "red-hat-consulting-gitlab-breach-october-2025", "title": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025", "json": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Red Hat Consulting self-managed GitLab", "tags": [ "devtools", "red-hat", "gitlab", "crimson-collective", "shinyhunters", "data-breach", "extortion" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-10-01", "closedAt": "2025-10-10", "updatedAt": "2025-10-10", "summary": "The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.", "xPost": null } ], "posts": [ { "authorName": "Exploit Database", "handle": "ExploitDB", "avatarUrl": "https://pbs.twimg.com/profile_images/932975822926991360/xHkf5nKr_bigger.jpg", "text": "[webapps] Keycloak 26.​7.​2 - Unauthenticated Account Takeover dlvr.​it/TW0wH6", "date": "2026-10-21T17:46:13.000Z", "url": "https://x.com/ExploitDB/status/2112963684029088222", "media": [], "incident": "keycloak-cve-2026-18963-reset-credentials-takeover" } ], "changes": [ { "incident": "keycloak-cve-2026-18963-reset-credentials-takeover", "incidentTitle": "Keycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21", "title": "Exploit-DB publishes EDB-52699 \"Keycloak 26.7.2 - Unauthenticated Account Takeover\" by Abel Maldonado (Orevim): a PoC with a safe --check mode and a --set-password takeover mode, tested on Keycloak 26.6.2.", "body": null, "sourceUrl": "https://www.exploit-db.com/exploits/52699", "url": "https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover" }, { "incident": "keycloak-cve-2026-18963-reset-credentials-takeover", "incidentTitle": "Keycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-08-18", "title": "CVE-2026-18963 published with GitHub advisory GHSA-4gv3-mc9p-5wqc (critical); fixed in keycloak-services 26.4.15, 26.6.6 and 26.7.2, with Red Hat errata for Red Hat Build of Keycloak.", "body": null, "sourceUrl": "https://github.com/advisories/GHSA-4gv3-mc9p-5wqc", "url": "https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover" }, { "incident": "red-hat-consulting-gitlab-breach-october-2025", "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-10", "title": "FINRA alert to member firms", "body": null, "sourceUrl": "https://www.finra.org/rules-guidance/guidance/red-hat-security-incident-20251010", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025" }, { "incident": "red-hat-consulting-gitlab-breach-october-2025", "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-02", "title": "Red Hat confirms the incident", "body": null, "sourceUrl": "https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025" }, { "incident": "red-hat-consulting-gitlab-breach-october-2025", "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-10-01", "title": "Crimson Collective claims the Red Hat GitLab theft", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/", "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025" } ] }