Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-86464 – Authentication Bypass / Full Identity System Compromise – Eclipse aeriOS Identity M

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-86464 is a critical (CWE-200, CWE-306, CWE-798, CWE-1188, CWE-1392) insecure-defaults vulnerability in the development branch of Eclipse aeriOS, affecting the deployment configuration of its Identity Manager (IdM), which is built on Keycloak, PostgreSQL, and OpenLDAP. Development builds exposed these backend services externally with hardcoded, publicly known credentials and insufficient access controls. An attacker who can reach the exposed services can use the published default credentials to gain administrative access to the Identity Manager or direct database access.

Technical details

  • Root cause: insecure default configuration shipped in aeriOS’s Helm chart and Docker Compose deployment files, combined with hardcoded administrator and database credentials and predefined development/test user accounts with known passwords.
  • Trigger conditions: the Keycloak admin console/API and PostgreSQL database were reachable via Kubernetes NodePort services (Keycloak, PostgreSQL) and via all network interfaces in Docker Compose deployments, with no requirement to change default credentials before production use.
  • Attack vector: Network — no authentication, privileges, or user interaction required (CVSS v4.0 AV:N/AC:L/AT:N/PR:N/UI:N).
  • Impact: unauthorized access to or modification of identity-management data (users, roles, client credentials, sessions, cryptographic material), and the ability to create privileged identities or tokens that are trusted by other aeriOS components — resulting in full compromise of confidentiality, integrity, and availability of the identity system.

Affected software

  • Eclipse aeriOS Identity Manager (IdM) deployment tooling, development branch — commits between 459fa98e95b1865d01b8d14d6cce5908ba2b18ba and c6efc450baf912385681198b2477c1ba4e93f91a.
  • Versions/commits after this range include the fix; no released stable version prior to the fix was listed as affected.

Severity

CVSS v4.0 Base Score: 9.9 (Critical)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Mitigation and recommended actions

  • Immediate: update to a commit/release after c6efc450baf912385681198b2477c1ba4e93f91a, which generates a random Keycloak administrator password by default, manages Keycloak and PostgreSQL credentials via Kubernetes Secrets, and restricts PostgreSQL and OpenLDAP to internal-only network access in both the Helm chart and Docker Compose deployment.
  • If unable to patch immediately: rotate all default/hardcoded Keycloak admin and PostgreSQL credentials, remove or disable predefined development/test user accounts, and restrict network exposure of Keycloak, PostgreSQL, and OpenLDAP so they are not reachable from outside the internal deployment network (e.g., remove NodePort exposure, bind Docker Compose services to internal interfaces only).
  • Review any tokens or identities issued by an exposed Identity Manager instance, as they may need to be revoked/rotated following remediation.

How IONIX identifies potentially affected assets

IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.

  • Raw response body: <form action=".../auth/realms/...">, href=".../keycloak/img/favicon.ico", href=".../keycloak/...">
  • URL of a loaded script: keycloak.js, keycloak-<version>.min.js
  • JavaScript object present once the page runs: typeof Keycloak !== 'undefined'

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge