Security1 publisher2 min readPublished
Unauthenticated attackers can reset any Industrial Edge Management password without the email link
CVE-2026-18963 sits in the Keycloak reset-credentials flow that Siemens embeds in Industrial Edge Management. Siemens closed its own Cloud service on September 2, and owners of self-hosted IEM Pro and IEM Virtual patch or block the path themselves.
The Watch · Security desk
What happened
- CVE-2026-18963 lets an unauthenticated remote attacker take over any Siemens Industrial Edge Management account by resetting its credentials without completing email verification.
- The defect is in the reset-credentials flow of keycloak-services, the identity and access management engine in the Red Hat Build of Keycloak that Siemens ships inside Industrial Edge Management.
- Siemens fixed IEM Pro V1 in V1.15.20, Pro V2 in V2.2.2 and IEM Virtual in V2.9.1, while IEM Cloud is listed as affected in all versions.
- For the Cloud service, Siemens applied firewall rules on 2026-08-26 and the fixing update on 2026-09-02, and says no user actions are necessary.
- Interim options are blocking internet access to IEM Pro or Virtual, blocking the reset-credentials path at a WAF or reverse proxy, or switching Forgot password off in the Keycloak realm settings.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Anyone who can load the login page of an internet-reachable IEM Pro or Virtual instance can take an account on it. No credential, no session and no access to the victim's mailbox is required.
- cost The two interim measures that avoid a version change both switch off self-service password reset, so every forgotten password becomes a manual job for whoever staffs the helpdesk until the update lands.
- contradiction The Cloud entry's "all versions" range looks like the worst exposure in the table, but Siemens's own remediation line says the service was mitigated and then fixed centrally with nothing for customers to do.
- constraint Updating IEM closes Siemens's copy of the bug only. The vulnerable code belongs to keycloak-services, so any other product embedding that reset flow needs a separate fix from its own vendor.
CISA files CVE-2026-18963 under CWE-640, weak password recovery mechanism for forgotten password, and the description is the literal version of that class [12]. The reset-credentials flow in keycloak-services completes a reset that the emailed link never confirmed, so an attacker who can load the login page picks a user and sets that user's password directly [2]. Control of the target's mailbox is not part of the chain [2].
The affected bands are narrow in two products and wide in the third. IEM Virtual is affected from 2.6.0 through 2.9.0, with the fix in 2.9.1 [7][18]. Pro V1 covers 1.14.9 through 1.15.19 [5][20]. On Pro V2 only two builds are in range, 2.2.0 and 2.2.1 [6][17].
Siemens put firewall rules in front of the Cloud service on 2026-08-26 and shipped the fixed build there on 2026-09-02, seven days later [8][19]. The mitigation predates the code fix by a week. Self-hosted operators are now being asked to cover a similar gap with a similar kind of control.
The first measure Siemens lists is blocking direct internet access to IEM Pro or IEM Virtual, which it calls the most effective immediate measure and says ensures no external attack can occur via this vulnerability [9]. Leading with that implies the vendor expects some of these instances to be reachable from the internet. An IEM already behind segmentation is not under the same clock.
Siemens ProductCERT reported the vulnerability to CISA, which lists the sector as Critical Manufacturing and deployment as worldwide [13][14]. CISA's advisory does not include a CVSS score or any report of exploitation. Siemens tracks the issue as SSA-503852, Authentication Bypass Vulnerability in Industrial Edge Management [15].
For the self-hosted builds the options are the update to V1.15.20, V2.2.2 or V2.9.1, or the path block on /auth/realms/customer/login-actions/reset-credentials that Siemens published while customers get there [5][6][7][10].
What to watch
- Whether other products embedding the same keycloak-services reset-credentials flow publish their own advisories and CVE mappings.
- Any reported scanning or exploitation against /auth/realms/customer/login-actions/reset-credentials on internet-facing IEM instances.
- Whether CISA adds CVSS metrics to the advisory or Siemens revises SSA-503852 with further affected versions.