{"uuid": "b47b722e-3b9c-4f17-839a-7be8e6e79759", "vulnerability": {"vulnId": "CVE-2026-18963", "altId": []}, "gcve": {"origin_uuid": "caeb2787-0d58-4236-9039-7c86c3e566f3", "object_uuid": "b47b722e-3b9c-4f17-839a-7be8e6e79759"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-08-25T15:13:17+00:00"}, "timestamps": {"asserted_at": "2026-08-25T15:13:17+00:00", "recorded_at": "2026-08-26T16:00:01+00:00", "first_seen_at": "2026-08-25T15:13:17+00:00"}, "scope": {"notes": "Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass | Affected: Red Hat / Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.15, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.6, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7 | CVSS: 9.1 (CRITICAL) | EPSS: 0.02788 | Used in malware: unknown | Not yet in CISA KEV: True"}, "evidence": [{"type": "public_report", "source": "previdian", "signal": "successful_exploitation", "confidence": 0.7, "details": {"feed": "Previdian (previdian.com)", "title": "Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass", "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.15, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.6, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7", "added_date": "2026-08-25T15:13:17.550Z", "cvss_score": 9.1, "epss_score": 0.02788, "cvss_severity": "CRITICAL", "epss_percentile": 0.85319, "used_in_malware": "unknown", "ahead_of_cisa_kev": null, "not_yet_in_cisa_kev": true}}], "references": [{"id": "CVE-2026-18963", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18963"}, {"id": "previdian", "url": "https://previdian.com/CVE-2026-18963"}]}