Cyber Resilience

CVE-2026-7307

HighUpdated

Published: 19 May 2026

Published
19 May 2026
Modified
03 June 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0073 49.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-7307 is a high-severity Improper Validation of Syntactic Correctness of Input (CWE-1286) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 49.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a…

more

Denial of Service (DoS) where the server becomes unavailable.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Direct match to application/system exploitation causing endpoint DoS via crafted SAML XML input leading to CPU exhaustion and thread starvation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-7507Same product: Redhat Build Of Keycloak
CVE-2026-4636Same product: Redhat Build Of Keycloak
CVE-2026-7504Same product: Redhat Build Of Keycloak
CVE-2026-4634Same product: Redhat Build Of Keycloak
CVE-2026-3872Same product: Redhat Build Of Keycloak
CVE-2026-4282Same product: Redhat Build Of Keycloak
CVE-2026-7571Same product: Redhat Build Of Keycloak
CVE-2026-9795Same product: Redhat Build Of Keycloak
CVE-2026-3260Same vendor: Redhat
CVE-2026-3047Same product: Redhat Build Of Keycloak

Affected Assets

redhat
build of keycloak
26.4 — 26.4.12

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References