What is CVE-2026-10579?
CVE-2026-10579 is an authentication bypass in PicketLink Federation, the SAML identity federation component shipped with Red Hat JBoss Enterprise Application Platform. The flaw sits in the handler that processes unsolicited SAML responses, which accepts forged assertions without performing verification or validation.
The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical). Red Hat published the record on August 11, 2026 and rates the security impact as Critical.
Exploitation is pre-authentication. An attacker needs network access to the endpoint that consumes SAML responses and nothing else. No credentials, no user interaction, and no prior foothold are required.
The practical impact is identity forgery. An attacker constructs a SAML assertion naming any principal and any role, submits it to the unsolicited response handler, and the handler treats it as legitimate. Administrator accounts are in scope. Because the bypass happens at the federation layer, the application behind it receives a session that looks fully authenticated and correctly authorized, and applies no further scrutiny. Downstream effects include information disclosure and access to restricted operations.
What assets are affected by CVE-2026-10579?
Red Hat lists Red Hat JBoss Enterprise Application Platform 7 and Red Hat JBoss Enterprise Application Platform 8 as affected products. The advisory does not name specific vulnerable or fixed version ranges at the time of writing, so scoping has to be done against the deployed picketlink-federation component rather than the EAP release number alone.
In practice, an affected asset is a Java application server acting as a SAML service provider. The exposure exists where PicketLink federation is configured and the endpoint that consumes SAML responses is reachable from an untrusted network. This pattern is common in single sign-on deployments that front internal business applications, partner portals, and customer-facing account systems. These are exactly the applications that get published to the internet by design, because federated login is the point.
Two deployment habits widen the exposure. First, SAML service provider endpoints are usually left open to any source, since the identity provider redirect can originate from anywhere the user happens to be. Second, JBoss EAP carries long service lives. Application servers running line-of-business software are patched on release cycles measured in quarters, not days, and the federation stack inside them is rarely inventoried separately from the platform.
What does our data show about exposure patterns?
Exposure in this set is led by Consumer Discretionary at 32.7% of observed assets, with Financials contributing 23.1% and Information Technology 21.2%.
Consumer Discretionary and Financials share the operational profile that produces this kind of exposure. Both run large federated identity estates that span franchise operations, regional subsidiaries, acquired brands, and third-party service providers. Federation exists precisely because the identity boundary crosses organizational lines, and each crossing adds a service provider endpoint that has to stay externally reachable. Financials add a regulatory dimension: long-lived customer account systems built on Java application servers are expensive to re-platform, so the federation layer in front of them tends to outlast the software it was originally paired with.
The cross-sector pattern points to an inventory problem rather than a patching problem. PicketLink is a component inside a platform, not a product an organization tracks on its own. Asset owners who can answer which version of JBoss EAP they run often cannot answer whether federation is enabled on a given instance, or which endpoint accepts unsolicited responses. That gap between platform-level inventory and component-level exposure is what leaves these assets reachable after a critical advisory lands.
Are fixes available?
No fixed version has been published at the time of writing. Red Hat has assigned the CVE and rated it Critical against JBoss EAP 7 and JBoss EAP 8, but has not yet released errata naming a corrected picketlink-federation build.
The advisory also does not specify affected version ranges. That combination matters operationally: defenders cannot confirm they are safe by version number, and cannot confirm they are patched either. Every JBoss EAP instance with PicketLink federation configured should be treated as vulnerable until Red Hat states otherwise.
Organizations should track the Red Hat CVE page for CVE-2026-10579 directly and verify status with Red Hat support rather than relying on third-party vulnerability feeds, which are currently propagating the record without patch data.
Are there any other recommended actions to take?
Until a fix is confirmed, defenders should:
- Inventory all JBoss EAP instances and identify which have PicketLink federation configured
- Restrict access to SAML service provider endpoints to known identity provider source ranges
- Disable unsolicited response handling where the application does not require IdP-initiated login
- Monitor authentication logs for sessions established without a preceding authentication request
- Audit recent privileged sessions for principals that do not match known account activity
- Rotate SAML signing certificates and session secrets on any instance showing anomalous assertions
How can CyCognito help your organization?
CyCognito published an Emerging Threat Advisory for CVE-2026-10579 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.
To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.
