NetEye Product Security has rated this update as having a critical security impact.
Topic
An update for the keycloak packages is now available for NetEye 4.
Security Fix for NetEye 4.49
26.7.2_neteye1.46.1-1
Summary
This vulnerability, tracked as CVE-2026-18963 (CVSS 9.1, Critical), affects the reset-credentials authentication flow in Keycloak. Due to improper state validation, an unauthenticated remote attacker can send a specially crafted request that causes the authentication session to transition directly to the password update phase, skipping the action token that is normally sent via email. Successful exploitation results in a complete account takeover of any user, including administrative accounts, without any user interaction required.
For details on how to apply this update, which includes the changes described in this advisory, refer to the NetEye Update Section in the User Guide.
Affected Products
All NetEye 4.x versions >= 4.38.
Please note that the “Forgot password” (reset-credentials) feature is disabled by default in NetEye. Installations are affected by this vulnerability only if this feature has been explicitly enabled on one or more realms.
Important: GLPI security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the glpi packages is now available for NetEye 4. Security Fix for NetEye 4.50 glpi-11.0.11_neteye1.25.3-1 glpi-autosetup-11.0.11_neteye1.25.3-1 glpi-configurator-11.0.11_neteye1.25.3-1 glpi-neteye-config-11.0.11_neteye1.25.3-1 Summary This is Read More
NATS: Fix multi-tenancy configuration corruption in cluster environments When executing commands such as neteye install --restrict-services-to nats-server, neteye tenant config apply, or neteye satellite config create from a cluster node while nats-server was active on a different node, the shared Read More
Important: Grafana security update Type/Severity NetEye Product Security has rated this update as having a medium security impact. Topic An update for the grafana packages is now available for NetEye 4. Security Fix for NetEye 4.49 and 4.50 grafana-12.4.12_neteye3.31.4-1 Summary Four medium-severity CVEs Read More
Fixes for nginx and nginx-satellite We identified and fixed two issues affecting nginx resource management during service and resource restarts. nginx-satellite.service An issue could leave nginx worker processes running after nginx-satellite.service entered a failed state. These processes could continue listening Read More
When the GLPI inventory plugin is used to collect agent inventories, assets may fail to appear in GLPI even though the agents reach the server. The cause was a bug in the Icinga Web 2 SSO plugin: GLPI 11 marks Read More
