Red Hat Hardened Images on AWS Scanner and Critical Keycloak, NetScaler Flaws: Hybrid Cloud Security Update

Late August 2026 brought a cluster of security changes that matter to anyone running workloads on European or global infrastructure. Red Hat announced that its Hardened Images are now supported in the AWS InspectorScan API and Amazon ECR Basic scanning, a move aimed at cutting vulnerability noise in container pipelines. At the same time, a critical Keycloak flaw (CVE-2026-18963) lets unauthenticated attackers reset passwords and seize accounts, while CISA added six actively exploited vulnerabilities to its KEV catalog, including a NetScaler memory overflow and a long-standing Microsoft SQL Server RCE. For hosting buyers, sysadmins, and cloud operators, the common theme is supply-chain trust and fast patch cycles.

Red Hat Hardened Images Gain AWS InspectorScan and ECR Basic Support

The Red Hat Friday Five update for August 28, 2026 confirms that AWS InspectorScan API and ECR Basic scanning now recognize Red Hat Hardened Images. For teams storing enterprise open-source container images in Amazon Elastic Container Registry (ECR), this means vulnerability scans can map results against a curated, hardened baseline rather than a generic upstream distribution. The stated benefits are fewer false-positive vulnerability alerts, easier verification of software supply-chain integrity, and smoother compliance across hybrid cloud workflows.

For a more detailed walkthrough of this part of the topic, read Critical Security Alert: VMware Announces Severe "VM Escape" Vulnerabilities.

In practice, if you run RHEL-based containers on EKS or self-managed Kubernetes that pull from ECR, your existing Basic scanning job can now attribute findings to the hardened image profile. That should reduce the time spent triaging CVEs that do not apply to your configured baseline. However, the research does not specify whether this support changes scan pricing, region availability, or required IAM permissions. Operators should still maintain their own image pinning, SBOM, and rollback plan. Scanning integration is not a substitute for timely patching; it is a filter that makes patch prioritization clearer.

We also note that Red Hat’s same update briefly mentioned general availability of a new automation orchestrator for Ansible Automation Platform, but the provided research truncates those details. We cannot confirm its feature set or hosting relevance beyond the announcement.

Keycloak CVE-2026-18963: Unauthenticated Account Takeover via Password Reset

The Hacker News reporting and Red Hat advisory describe a critical weakness in Keycloak, the open-source identity and access management server widely used to broker SSO for hosting control panels, WordPress instances, and APIs. Assigned CVE-2026-18963 and rated CVSS 9.1 by Red Hat, the flaw is classified as weak password recovery (CWE-640). The root cause is improper state validation within the reset-credentials authentication flow.

Normally, a user who forgets a password receives an action token by email; that token gates the update phase. With this defect, an attacker sends a crafted request to the reset-credentials endpoint, and the authentication session transitions directly to password update without the email token. An unauthenticated remote actor can thus reset the password of any account, including administrators, and gain full control.

Patches are available: upstream Keycloak users must move to version 26.7.2 (released August 19, 2026), while customers on Red Hat build of Keycloak (RHBK) should apply 26.4.15 or 26.6.6. As of August 24, 2026, there was no evidence of exploitation and no public exploit, but the low barrier to attack makes immediate upgrading essential. If your hosting stack uses Keycloak for customer login or infra access, treat this as a change-window priority. Verify backups of the Keycloak database before upgrading, and test the reset flow in staging to confirm the email token is now mandatory.

CISA KEV Additions: NetScaler Memory Overflow and Microsoft SQL RCE

On August 26, 2026, CISA added six new flaws to its Known Exploited Vulnerabilities catalog, signaling confirmed in-the-wild abuse. Two high-severity entries are directly relevant to hosting infrastructure. First, CVE-2026-8452 is a memory overflow in NetScaler ADC and NetScaler Gateway, scored CVSS 8.8. Citrix reports exploitation leads to unpredictable behavior or denial of service when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Patched builds include NetScaler ADC and Gateway 14.1-72.61+, 13.1-63.18+, 14.1-FIPS 14.1-72.61 FIPS+, and 13.1-FIPS/NDcPP 13.1.37.272+. Hosting providers using NetScaler for client VPN or load balancing must schedule updates and monitor for anomalous reset behavior.

Second, CVE-2019-1068 is a remote code execution bug in Microsoft SQL Server, also CVSS 8.8. Although a patch has existed since 2019, CISA’s addition shows attackers still compromise unpatched database servers. If you run MS SQL on VPS or dedicated servers, apply the cumulative update and restrict network exposure. The research does not list the other four KEV entries in detail; we therefore cannot describe them, but operators should review the full CISA alert to confirm none affect their Linux, Red Hat, or other components.

What Hosting Operators Should Verify Next

The convergence of container scanning improvements and critical identity/edge flaws suggests a clear workflow. Start with an inventory: which ECR repositories use Red Hat Hardened Images, and are InspectorScan or ECR Basic scans enabled? Enable the integration if not, then review the reduced alert stream for real pending patches. Next, check every Keycloak deployment—including containers, VMs, and managed services—against the fixed versions. Automate the upgrade where possible, but retain a snapshot for rollback.

For perimeter and data-tier systems, confirm NetScaler build numbers and SQL Server patch levels. If a NetScaler is only used as a pure load balancer without Gateway features, the DoS vector may be lower, but the memory overflow still warrants patching. For SQL, audit firewall rules and disable internet-facing TCP 1433. Finally, subscribe to CISA KEV and Red Hat advisories; the Ansible Automation Platform orchestrator mentioned by Red Hat could help unify these tasks, though its exact capabilities are not confirmed in our research.

Key Takeaways and Practical Checklist:

Enable AWS InspectorScan / ECR Basic scanning for Red Hat Hardened Images to cut vulnerability noise.
Upgrade upstream Keycloak to 26.7.2 or RHBK to 26.4.15 / 26.6.6 to close CVE-2026-18963.
Patch NetScaler ADC/Gateway to listed 13.1 or 14.1 fixed builds to mitigate CVE-2026-8452.
Apply Microsoft SQL Server updates for CVE-2019-1068 and block external DB ports.
Review CISA KEV catalog for the remaining four added flaws not detailed here.
Test identity reset flows after patching and keep database backups before upgrades.

Security in hybrid hosting environments is rarely about a single patch; it is about reducing signal noise while closing high-impact gaps fast. The AWS and Red Hat scanning alignment helps teams focus, but the Keycloak and NetScaler disclosures prove that identity and edge devices remain prime targets. European and global operators should use this week’s updates as a prompt to audit containers, identity providers, and appliances, then document a repeatable patch process.

Faceți căutări pe acest blog

Web Hosting