[NEW] [UNPATCHED] [medium] Keycloak: Multiple vulnerabilities

mediumCVE-2026-15943 CVE-2026-16072 CVE-2026-16089 CVE-2026-16093 CVE-2026-16103 CVE-2026-16104

An attacker can exploit multiple vulnerabilities in Keycloak to bypass security measures, manipulate data, and disclose confidential information.

CSIRTS triage

vendor: Keycloak product: Keycloak Authentication bypass Information disclosureOther

What: Multiple vulnerabilities allow attackers to bypass security measures and manipulate data.
Who is affected: Attackers targeting Keycloak deployments.
Urgency: Remediation is medium urgency as the vulnerabilities are unpatched and can lead to significant risks.
Action: Monitor for updates and apply patches when available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Keycloak

Get an email when a new Keycloak advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: medium
Published: 2026-08-31
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2407

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-159430.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-160720.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-160890.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-160930.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-161030.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-161040.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-161060.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-161080.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-15943	coverage & exploitation status	NVD · CVE.org
CVE-2026-16072	coverage & exploitation status	NVD · CVE.org
CVE-2026-16089	coverage & exploitation status	NVD · CVE.org
CVE-2026-16093	coverage & exploitation status	NVD · CVE.org
CVE-2026-16103	coverage & exploitation status	NVD · CVE.org
CVE-2026-16104	coverage & exploitation status	NVD · CVE.org
CVE-2026-16106	coverage & exploitation status	NVD · CVE.org
CVE-2026-16108	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Keycloak

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-89298: A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identi…nvd · 2026-09-11
mediumCVE-2026-88770: A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access ma…nvd · 2026-09-10
mediumCVE-2026-19729: A flaw was found in the key provider component of the keycloak-services library, which is the …nvd · 2026-09-09
high[UPDATE] [hoch] Keycloak: Mehrere Schwachstellencert-bund · 2026-09-08
mediumCVE-2026-82968: A flaw was found in the first-broker-login flow of the Keycloak identity management service. W…nvd · 2026-09-02
medium[UPDATE] [medium] Keycloak (netty-codec-http): Vulnerability allows file manipulationcert-bund · 2026-09-01