Siemens Industrial Edge Management auth bypass flaw
An unauthenticated attacker can bypass email verification to reset credentials and take over accounts in Siemens Industrial Edge Management.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2026-18963 (templated); no exploitation in the wild is recorded.
Siemens Industrial Edge Management is affected by an authentication bypass vulnerability (CVE-2026-18963) in the reset-credentials flow of the keycloak-services component, which underpins identity and access management in Red Hat Build of Keycloak. The flaw allows an unauthenticated remote attacker to force a password reset for any user account without needing to complete the required email verification step, resulting in full account takeover by directly setting new credentials.
Affected products include Industrial Edge Management Cloud (all versions), Industrial Edge Management Pro V1 (>=1.14.9, <1.15.20), Pro V2 (>=2.2.0, <2.2.2), and Virtual (>=2.6.0, <2.9.1). Siemens has released fixed versions (V1.15.20, V2.2.2, V2.9.1) and applied firewall-based mitigations on 2026-08-26, with the vendor fix completed 2026-09-02. Interim mitigations include blocking direct internet access to IEM Pro/Virtual instances, blocking the /auth/realms/customer/login-actions/reset-credentials path via WAF/reverse proxy, or disabling password reset functionality in Keycloak realm settings.
This is a critical manufacturing sector ICS advisory from CISA, republished verbatim from Siemens ProductCERT SSA-503852. No evidence of in-the-wild exploitation is mentioned in the advisory. Defenders operating affected Industrial Edge Management deployments should prioritize patching or applying the documented mitigations, and should ensure control system components are not directly exposed to the internet as a general practice.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-06
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs