Is CVE-2026-9794 actively exploited?

No active exploitation of CVE-2026-9794 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-9794 be exploited remotely?

Yes. CVE-2026-9794 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-9794?

CVE-2026-9794 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-9794

MEDIUM

CVE-2026-9794

CWE-209Published: May 28, 2026· Updated: Jun 3, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.8th

Official Description

A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.

NVD Source

Technical Analysis

CVE-2026-9794 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.