Account-Takeover on CuraSec

Critical Keycloak Password Reset Flaw Enables Unauthenticated Account Takeover

Tue, 25 Aug 2026 11:39:54 +0000

Engineer — Act: Keycloak is a common IAM component in Kubernetes and cloud stacks; a public PoC for unauthenticated account takeover makes exploitation practical regardless of the low EPSS. Patch Keycloak to the fixed release immediately and audit authentication logs for anomalous password-reset activity since disclosure.
SOC/IR — Plan: No active exploitation or IOCs yet, but a public PoC raises the likelihood of opportunistic abuse soon. Build or tune a detection for high-volume or cross-account password-reset requests against Keycloak endpoints so you are ready to alert when attempts begin.
Leader — Plan: An unauthenticated takeover flaw in an IAM server is high-blast-radius if exploited — it could affect all accounts in the realm. Confirm your engineering team has scheduled the Keycloak patch and verify whether any customer-facing SSO flows depend on it.
Signals: CVE-2026-18963 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Sat, 25 Jul 2026 12:08:50 +0000

Engineer — Skip
SOC/IR — Plan: AiTM (adversary-in-the-middle) phishing bypasses MFA by proxying sessions in real time; build or tune detections for impossible-travel, session token anomalies, and auth from new ASNs immediately after login events.
Leader — Learn: Real-time session hijacking erodes MFA as a control — useful context for risk register and security awareness program updates, but no immediate action required given no corroborating signals or named breach.

Thu, 16 Jul 2026 12:18:39 +0000

Engineer — Plan: Zoom’s Windows desktop client and SDK carry a critical unauthenticated account-takeover flaw — high severity but no KEV listing or public PoC moves this to Plan rather than Act. Update Zoom Windows clients and any SDK integrations to the patched version as soon as your next patch window allows.
SOC/IR — Learn: No IOCs, active exploitation evidence, or mapped TTPs accompany this advisory, so there is no immediate detection or hunt work. File awareness of the attack vector (unauthenticated ATO on Zoom Windows) so detection rules can be prioritized if exploitation begins appearing in the wild.
Leader — Plan: Zoom is standard enterprise communication infrastructure, and a critical unauthenticated account-takeover flaw warrants confirming that endpoint and IT teams are deploying the patched client org-wide. Without reported exploitation this does not require leadership escalation yet, but track it for the next risk review.

Thu, 16 Jul 2026 12:18:39 +0000

Engineer — Act: A public PoC on GitHub for a CVSS 9.8 improper-input-validation flaw in Zoom Desktop Client, VDI Client, and Meeting SDK for Windows raises exploitation risk significantly even without KEV listing; update all three Zoom Windows products to the patched versions immediately.
SOC/IR — Act: With a public PoC in circulation for a critical Zoom account-takeover vulnerability, exploitation attempts against unpatched Windows endpoints are plausible now; hunt for anomalous Zoom process behavior and unexpected authentication events since the patch cycle may lag exposure.
Leader — Plan: Zoom is near-universal in enterprise environments, and a CVSS 9.8 flaw with a public PoC in the Windows client warrants confirming with engineering that patching is tracked and on a days-not-weeks timeline before this surfaces in customer security questionnaires.
Signals: CVE-2026-53412 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub