This advisory covers two security vulnerabilities in Red Hat's build of Keycloak 26.2.8. The first, CVE-2025-9162, relates to variable injection into environment variables, which could allow unintended manipulation of environment settings. The second, CVE-2025-8419, is an SMTP injection vulnerability that could potentially be exploited via the email sending functionality of Keycloak. The advisory does not specify affected versions or provide direct patch links but indicates that updated packages are available from the Red Hat Customer Portal. The vulnerabilities are classified as moderate severity.

The vulnerabilities could allow an attacker to inject malicious variables into environment variables or exploit SMTP injection, potentially impacting the security of authentication and single sign-on services provided by Keycloak. The exact impact details and exploitation scenarios are not described in the advisory. There are no known exploits in the wild at the time of publication.

Red Hat recommends backing up existing installations, including applications, configuration files, and databases, before applying the update. Updated packages for Red Hat build of Keycloak 26.2.8 are available from the Red Hat Customer Portal. Users should apply these updates to remediate the vulnerabilities. Patch status is not explicitly confirmed in the advisory text; users should consult the Red Hat Customer Portal for the latest remediation guidance.