Siemens Industrial Edge Management
Siemens Industrial Edge Management has a critical unauthenticated password-reset flaw enabling remote account takeover.
CISA republished Siemens ProductCERT SSA-503852 for CVE-2026-18963, a weak password-recovery flaw in Industrial Edge Management. An unauthenticated remote attacker can complete a password reset without the email verification link and take over accounts. CVSS 3.1 is 9.1. Affected ranges are Cloud (all versions), Pro V1 from 1.14.9 before 1.15.20, Pro V2 from 2.2.0 before 2.2.2, and Virtual from 2.6.0 before 2.9.1. The defect is in the Keycloak reset-credentials flow; the advisory does not report exploitation.
- CVE-2026-18963 has CVSS 9.1 and requires no authentication.
- Unauthenticated attackers can reset any user's password without email verification.
- Affected products are Edge Management Cloud, Pro V1, Pro V2, and Virtual.
- Siemens urges updates; the flaw sits in Keycloak's reset-credentials flow.
- CVEs
- CVE-2026-18963
- Organizations
- CISASiemens ProductCERT
- Countries
- Germany
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-18963 | Unauthenticated Account Takeover via Password Reset Flow in Red Hat Build of Keycloak | 9.1 | 7% | PoC ×4 |
From the original article
3 min read at cisa.govView CSAF Summary Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versions for the affected products and recommends to update to the latest versions.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.