Siemens Industrial Edge Management (CVE-2026-18963)
Siemens Industrial Edge Management has a critical authentication bypass vulnerability (CVE-2026-18963, CVSS 9.1) enabling unauthenticated remote account takeover via password reset without email verification. The flaw exists in the reset-credentials flow of the Keycloak identity management component integrated into IEM. An unauthenticated attacker can force password resets for any user without completing email verification, achieving full account takeover. Siemens has released patched versions for all affected product lines.
Detection / Hunteropenrouter
Immediate Actions
- Block direct internet access to IEM Pro and IEM Virtual instances
- Configure WAF or reverse proxy to block /auth/realms/customer/login-actions/reset-credentials path
- Deactivate password reset in Keycloak realm settings
- Update to patched versions: V1.15.20, V2.2.2, or V2.9.1
Key Takeaways
- Affected versions: IEM Cloud (all), Pro V1 >=1.14.9 <1.15.20, Pro V2 >=2.2.0 <2.2.2, Virtual >=2.6.0 <2.9.1
- CVSS 3.1 base score 9.1 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Root cause: CWE-640 weak password recovery in keycloak-services reset-credentials flow
- Immediate mitigation: block /auth/realms/customer/login-actions/reset-credentials path via WAF or reverse proxy
- Patch versions: V1.15.20, V2.2.2, and V2.9.1 for Pro V1, Pro V2, and Virtual respectively
Attack Chain
- Reconnaissance: Attacker identifies internet-facing Siemens IEM instance
- Initial Access: Attacker accesses reset-credentials flow without authentication
- Credential Access: Attacker forces password reset for target user, bypassing email verification
- Persistence: Attacker sets new credentials, gaining full control of target account
Affected Systems
- Siemens Industrial Edge Management Cloud (all versions)
- Siemens IEM Pro V1 (>= 1.14.9, < 1.15.20)
- Siemens IEM Pro V2 (>= 2.2.0, < 2.2.2)
- Siemens IEM Virtual (>= 2.6.0, < 2.9.1)
- Red Hat Build of Keycloak (keycloak-services component)
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-18963 | Siemens Industrial Edge Management (keycloak-services / Red Hat Build of Keycloak) | Critical | Allows unauthenticated remote attacker to reset credentials without email verification, enabling full account takeover. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Web application layer exploit; EDR lacks visibility into HTTP request flows and Keycloak internals. |
| Network Visibility | Medium | WAF or reverse proxy logs capture requests to the reset-credentials path from unauthenticated sources. |
| Detection Difficulty | Easy | Single deterministic path to monitor; WAF or proxy logs sufficient for detection. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for unauthenticated POST requests to the reset-credentials path from external sources (T1190) | WAF or reverse proxy HTTP access logs | Initial Access | Low — legitimate resets require email verification step |
| Hunt for password reset events in Keycloak audit logs without corresponding email verification events (T1190) | Keycloak audit and event logs | Credential Access | Low — missing verification step is anomalous |
Required Log Sources
- WAF or reverse proxy access logs
- Keycloak audit events
- IEM application logs
- Network firewall logs
Key Behavioral Indicators
- Unauthenticated access to /auth/realms/customer/login-actions/reset-credentials
- Password reset events without prior email verification in Keycloak audit
- Multiple password reset attempts targeting different users from same source IP
- External IP access to IEM management interface
Control Gaps
- WAF not configured to block reset-credentials path
- IEM instances directly exposed to internet without firewall
- Keycloak password reset enabled in realm settings
- No network segmentation between IEM and business networks
False Positive Assessment
Low — unauthenticated access to reset-credentials path is anomalous; password resets without email verification are clear compromise indicators.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Isolate IEM instances behind firewalls, separate from business networks
- Use VPN for required remote access to IEM systems
- Apply Siemens operational guidelines for Industrial Security
User Protection
- Monitor IEM user accounts for unauthorized credential changes
- Verify IEM user accounts for evidence of forced password resets
MITRE ATT&CK Mapping
Initial Access
Plain-Language Summary
Siemens discovered a critical security flaw in its Industrial Edge Management software that lets attackers take over user accounts without a password. The flaw is in the password reset feature, which can be triggered without the required email confirmation. Organizations using affected versions should update immediately and block internet access to these systems.
- cveCVE-2026-18963Allows unauthenticated remote attacker to reset credentials without email verification, enabling full account takeover.