Status: UPDATED
| Advisory ID: CVE-2026-10579
Key Details
| CVE | CVE-2026-10579 |
| CVSS Score / Version | 9.8 (Critical) / CVSS v3.1 |
| Updated | 2026-09-25 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high. |
| Affected products | Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25, Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8, Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9, and Red Hat Red Hat JBoss Enterprise Application Platform 7 |
| Classified as | CWE-347 (Improper Verification of Cryptographic Signature) |
Affected Products, Subsystems & Sectors
| Subsystems | General OT |
| Sectors | Multiple |
What to Know
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.
References