Is CVE-2026-9792 actively exploited?

No active exploitation of CVE-2026-9792 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-9792 be exploited remotely?

Yes. CVE-2026-9792 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-9792?

CVE-2026-9792 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-9792

MEDIUM

CVE-2026-9792

CWE-280Published: May 28, 2026· Updated: Jun 3, 2026

6.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.6th

Official Description

A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the `reject-ropc-grant` executor is silently bypassed. This allows an unauthenticated remote attacker to obtain tokens via a Resource Owner Password Credentials (ROPC) grant, even when a policy is explicitly configured to block it. This bypass can lead to unauthorized access and information disclosure.

NVD Source

Technical Analysis

CVE-2026-9792 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.