NetEye Product Security has rated this update as having a critical security impact.
Topic
An update for the keycloak packages is now available for NetEye 4.
Security Fix for NetEye 4.49
26.7.2_neteye1.46.1-1
Summary
This vulnerability, tracked as CVE-2026-18963 (CVSS 9.1, Critical), affects the reset-credentials authentication flow in Keycloak. Due to improper state validation, an unauthenticated remote attacker can send a specially crafted request that causes the authentication session to transition directly to the password update phase, skipping the action token that is normally sent via email. Successful exploitation results in a complete account takeover of any user, including administrative accounts, without any user interaction required.
For details on how to apply this update, which includes the changes described in this advisory, refer to the NetEye Update Section in the User Guide.
Affected Products
All NetEye 4.x versions >= 4.38.
Please note that the “Forgot password” (reset-credentials) feature is disabled by default in NetEye. Installations are affected by this vulnerability only if this feature has been explicitly enabled on one or more realms.
NetEye upgrade causes RPMS of next release to be upgraded even if an update is required first We fixed a bug in NetEye 4.47 and 4.48 that caused the neteye upgrade command to update some NetEye packages even when packages Read More
Important: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.49 26.7.3_neteye1.46.1-1 Summary This Keycloak update (version 26.7.3) Read More
Icinga 2 live-creation requests are no longer lost during reload During a Director deployment, Icinga 2 reloads its configuration in the background. Previously, live-creation requests could still be processed for a short time after a reload had been requested. This Read More
Important: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic Updates for the Elastic Stack packages are now available for NetEye 4. Security Fix for NetEye 4.49 9.4.6_neteye3.103.8-1 CVEs Elastic Read More
Important: Icinga 2 security update Type/Severity NetEye Product Security has rated this update as having a medium security impact. Topic An update for the icinga package is now available for NetEye 4. Security Fix for NetEye 4.49 2.15.6_neteye1.73.1-1 Summary This release fixes authorization Read More
