Story · 1 source · 5 articlesfirst Sep 22, 12:00 UTCupdated Sep 24, 12:00 UTC (2d ago)

CISA republishes four Siemens ICS flaws and retracts one CVE

highVulnerabilityimportance 74CVE-2026-18963 CVE-2026-50093 CVE-2026-34223 CVE-2026-67367 CVE-2026-7891

What's new: First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrives

CISA republished four Siemens ICS advisories for critical and high flaws, then revoked a Mendix Runtime advisory after CVE-2026-7891 was retracted.

On 22 September 2026 CISA republished four Siemens industrial-control advisories covering unauthenticated or low-privilege flaws in Edge Management, Siveillance Control, Desigo CC, and SIMOVE Fleetmanager/SIPLANT. CVE-2026-18963 (CVSS 9.1) lets an unauthenticated remote attacker finish a Keycloak password reset without the email link on listed Edge Management Cloud, Pro V1, Pro V2, and Virtual ranges. CVE-2026-50093 (CVSS 9.0) is unrestricted file upload that can yield root on the Siveillance OIS server; Siemens lists fixed Control and Control Pro builds. CVE-2026-34223 (CVSS 8.2) executes insufficiently validated scripts in Desigo CC graphics when a privileged user opens a crafted document, and CVE-2026-67367 (CVSS 8.6) is path traversal that can expose secrets over an embedded HTTP server. None of those four advisories report exploitation. On 24 September 2026 CISA revoked the Mendix Runtime advisory ICSA-26-209-02 after CVE-2026-7891 was retracted as expected configuration rather than a vulnerability; the reports do not otherwise conflict.

On 2026-09-22 CISA republished four Siemens ProductCERT advisories: SSA-503852 (CVE-2026-18963, CVSS 3.1 9.1), SSA-254516 (CVE-2026-50093, CVSS 3.1 9.0), SSA-330084 (CVE-2026-34223, CVSS 3.1 8.2), and SSA-517424 (CVE-2026-67367, CVSS 3.1…
CVE-2026-18963 is an unauthenticated remote password-reset flaw in Industrial Edge Management’s Keycloak reset-credentials flow; affected ranges are Cloud (all versions), Pro V1 from 1.14.9 before 1.15.20, Pro V2 from 2.2.0 before 2.2.2,…
CVE-2026-50093 lets a low-privileged adjacent-network attacker upload arbitrary files and gain root on the Siveillance Open Interface Services server. Fixed builds start at Control Pro 3.0.12.2173 and 4.0.9.2178, and Control 3.0.22.2177…
CVE-2026-34223, reported by Michelin CERT, lets scripts in crafted Desigo CC graphics run when a privileged user opens them and write arbitrary files on the client. All Desigo CC V6 and V7 versions are listed as affected; access is local…
CVE-2026-67367 is unauthenticated relative path traversal in the embedded HTTP server of SIMOVE Fleetmanager and SIPLANT that can read credential stores, private keys, and configuration secrets. Fleetmanager builds before 3.1.13, 3.2.4,…
On 2026-09-24 CISA Update A revoked ICSA-26-209-02 for Siemens Mendix Runtime. CVE-2026-7891, previously scored CVSS 9.1, was retracted as expected configuration that does not expose the protected attribute; Siemens revoked SSA-814963. No…

VendorsSiemens Red Hat

ProductsIndustrial Edge Management Keycloak Siveillance Control Siveillance Control Pro Desigo CC SIMOVE Fleetmanager SIPLANT Mendix Runtime

OrganizationsCISA Siemens ProductCERT Michelin CERT Siemens

CountriesGermany

Coverage timelineoldest first · each row is one article

Sep 22, 12:00 UTC · 4d ago
CISA Advisories· 60
Siemens Desigo CC family
Siemens Desigo CC graphics documents can run attacker scripts and compromise client operating systems.
Sep 22, 12:00 UTC · 4d ago
CISA Advisories· 74
Siemens Industrial Edge Management
Siemens Industrial Edge Management has a critical unauthenticated password-reset flaw enabling remote account takeover.
Sep 22, 12:00 UTC · 4d ago
CISA Advisories· 58
Siemens SIMOVE Fleetmanager and SIPLANT
Siemens patched a high-severity path traversal in SIMOVE Fleetmanager and SIPLANT that can expose secrets.

Vulnerabilities in this storyAll →

CVE-2026-189639.13%
Unauthenticated Account Takeover via Password Reset Flow in Red Hat Build of Keycloak
published Aug 18, 2026· Red Hat Build of Keycloak (keycloak-services component, reset-credentials flow) PoC
CVE-2026-342238.6

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-18963	Unauthenticated Account Takeover via Password Reset Flow in Red Hat Build of Keycloak Red Hat Build of Keycloak contains a critical flaw (CVE-2026-18963) in the reset-credentials flow of the keycloak-services component, the core identity and access management engine (CWE-640, broken password recovery). An unauthenticated attacker with network access to the Keycloak server can trigger the password reset process for any user and bypass the required email verification link, directly setting new credentials for the target. This yields full account takeover of the victim user, including high impact to confidentiality and integrity, with no privileges, user interaction, or special conditions required. Any deployment of Red Hat Build of Keycloak is potentially affected; the affected version ranges are not specified in the available data, so defenders should consult the Red Hat advisory for fixed releases. No public proof of concept, CISA KEV listing, or confirmed in-the-wild exploitation is known yet, though EPSS assigns a 3.2% probability of exploitation within 30 days (87th percentile). Do: Identify all Red Hat Build of Keycloak deployments in your environment and upgrade to the fixed versions listed in the Red Hat advisory once published (specific fixed versions are not included in the available data). Until patching, restrict network exposure of Keycloak instances, and audit account/credential-change activity for unexpected password resets, since the flaw requires no authentication or user interaction. Monitor for suspicious password-reset email activity reported by users, which may indicate active probing or exploitation.	9.1	3%	PoC	Red Hat Build of Keycloak (keycloak-services component, reset-credentials flow)	large≈10,000s of deployments (public internet scans have catalogued tens of thousands of exposed Keycloak instances; RHBK-specific install counts and user totals…	Aug 18, 2026
CVE-2026-34223	Client Code Execution via malicious graphics documents in Siemens Desigo CC Siemens Desigo CC client applications (ClickOnce, Flex, and Installed Client variants) insufficiently validate scripts embedded in user-defined graphics documents, enabling script injection (CWE-94). To trigger it, an attacker must craft a graphics document containing malicious script commands and entice a user with sufficient privileges to open it in the client application; the embedded script then executes within that client instance. Successful exploitation allows the attacker to write arbitrary files to the client's operating system, which can lead to full compromise of the client workstation and lateral movement within the organization's network. All client variants and versions listed (V6 through V9) are affected, so operators and engineers running Desigo CC building-management clients are in scope. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a roughly 0.1% probability of exploitation within 30 days (3rd percentile). Do: No fixed versions are listed in this record, so check the Siemens ProductCERT advisory for CVE-2026-34223 and apply updated client builds when released. Until then, only open or import user-defined graphics documents from trusted sources, avoid shared graphics libraries of unknown origin, and run Desigo CC clients under least-privilege accounts to limit file-write impact. Inventory which client variants (ClickOnce, Flex, Installed) and versions (V6–V9) are deployed and whether users routinely open externally supplied graphics.	8.6	<1%		Siemens Desigo CC ClickOnce Client V6 (all versions) Siemens Desigo CC ClickOnce Client V7 (all versions)
CVE-2026-50093	Arbitrary File Upload in Siemens Siveillance Control OIS Web Module Leads to Root Access Siemens has disclosed an unrestricted file upload flaw (CWE-434) in the OIS web module of its Siveillance Control and Siveillance Control Pro building security management platforms. An attacker with low privileges and adjacent network access to the OIS environment can upload arbitrary files to the server. Successful exploitation can escalate to root access on the host system, resulting in a full compromise of the affected OIS environment. All affected branches are covered: Siveillance Control Pro V3.0 before V3.0.12.2173, Control Pro V4.0 before V4.0.9.2178, Control V3.0 before V3.0.22.2177, and Control V4.0 before V4.0.11.2177. There is no known public proof of concept, the issue is not in CISA's KEV catalog, and EPSS currently estimates only a 0.2% chance of exploitation in the next 30 days, indicating no known in-the-wild exploitation. Do: Upgrade Siveillance Control Pro V3.0 to V3.0.12.2173 or later, Control Pro V4.0 to V4.0.9.2178 or later, Control V3.0 to V3.0.22.2177 or later, and Control V4.0 to V4.0.11.2177 or later. Until patched, restrict network access to the OIS web module to trusted users and segments, since exploitation requires low-privileged access on an adjacent network. Review the OIS host for unexpected files or unusual privilege activity as a precaution.	8.9	<1%		Siemens Siveillance Control Pro V3.0 series: all versions < V3.0.12.2173 Siemens Siveillance Control Pro V4.0 series: all versions < V4.0.9.2178 Siemens Siveillance Control V3.0 series: all versions < V3.0.22.2177 +1 more
CVE-2026-67367	Unauthenticated Directory Traversal File Read in Siemens SIMOVE Fleetmanager and SIPLANT Siemens SIMOVE Fleetmanager and SIPLANT contain a directory traversal flaw (CWE-23) in the file-serving endpoint of an embedded HTTP server, which fails to validate and neutralize traversal sequences. An unauthenticated remote attacker can send crafted requests containing directory traversal sequences to this endpoint and read arbitrary files from the underlying operating system with no credentials required. Successful exploitation can expose sensitive data such as credential stores, private keys, and configuration secrets, potentially enabling follow-on compromise of the deployment. Affected users are operators running the listed SIMOVE Fleetmanager releases (V3.1 through V4.0 below the fixed versions) and any release of SIPLANT V1.7, V2.2, V3.0, or V3.1 below V3.1.4. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at only 0.8%, so no exploitation is currently known. Do: Upgrade SIMOVE Fleetmanager to V3.1.13, V3.2.4, V3.3.2, or V4.0.1 or later depending on your release line, and upgrade SIPLANT to V3.1.4 or later; SIPLANT V1.7, V2.2, and V3.0 have no listed fixed version, so check the Siemens ProductCERT advisory for update or migration options. Restrict network access to the embedded HTTP server (e.g., firewall rules or network segmentation) until patched. Because the flaw allows reading credential stores and private keys, review whether sensitive files were reachable on any exposed instance and rotate secrets if compromise is suspected.	9.2	<1%		Siemens SIMOVE Fleetmanager V3.1, all versions < V3.1.13 Siemens SIMOVE Fleetmanager V3.2, all versions < V3.2.4
CVE-2026-7891	Rejected reason: This CVE has been retracted Rejected reason: This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute. NVD description · AI analysis pending	9.1	<1%		—	—	May 7, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-18963

Unauthenticated Account Takeover via Password Reset Flow in Red Hat Build of Keycloak

Red Hat Build of Keycloak contains a critical flaw (CVE-2026-18963) in the reset-credentials flow of the keycloak-services component, the core identity and access management engine (CWE-640, broken password recovery). An unauthenticated attacker with network access to the Keycloak server can trigger the password reset process for any user and bypass the required email verification link, directly setting new credentials for the target. This yields full account takeover of the victim user, including high impact to confidentiality and integrity, with no privileges, user interaction, or special conditions required. Any deployment of Red Hat Build of Keycloak is potentially affected; the affected version ranges are not specified in the available data, so defenders should consult the Red Hat advisory for fixed releases. No public proof of concept, CISA KEV listing, or confirmed in-the-wild exploitation is known yet, though EPSS assigns a 3.2% probability of exploitation within 30 days (87th percentile).

Do: Identify all Red Hat Build of Keycloak deployments in your environment and upgrade to the fixed versions listed in the Red Hat advisory once published (specific fixed versions are not included in the available data). Until patching, restrict network exposure of Keycloak instances, and audit account/credential-change activity for unexpected password resets, since the flaw requires no authentication or user interaction. Monitor for suspicious password-reset email activity reported by users, which may indicate active probing or exploitation.

9.1

PoC

Red Hat Build of Keycloak (keycloak-services component, reset-credentials flow)

large≈10,000s of deployments (public internet scans have catalogued tens of thousands of exposed Keycloak instances; RHBK-specific install counts and user totals…

Aug 18, 2026

CVE-2026-34223

Client Code Execution via malicious graphics documents in Siemens Desigo CC

Siemens Desigo CC client applications (ClickOnce, Flex, and Installed Client variants) insufficiently validate scripts embedded in user-defined graphics documents, enabling script injection (CWE-94). To trigger it, an attacker must craft a graphics document containing malicious script commands and entice a user with sufficient privileges to open it in the client application; the embedded script then executes within that client instance. Successful exploitation allows the attacker to write arbitrary files to the client's operating system, which can lead to full compromise of the client workstation and lateral movement within the organization's network. All client variants and versions listed (V6 through V9) are affected, so operators and engineers running Desigo CC building-management clients are in scope. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a roughly 0.1% probability of exploitation within 30 days (3rd percentile).

Do: No fixed versions are listed in this record, so check the Siemens ProductCERT advisory for CVE-2026-34223 and apply updated client builds when released. Until then, only open or import user-defined graphics documents from trusted sources, avoid shared graphics libraries of unknown origin, and run Desigo CC clients under least-privilege accounts to limit file-write impact. Inventory which client variants (ClickOnce, Flex, Installed) and versions (V6–V9) are deployed and whether users routinely open externally supplied graphics.

8.6

<1%

Siemens Desigo CC ClickOnce Client V6 (all versions)
Siemens Desigo CC ClickOnce Client V7 (all versions)

CVE-2026-50093

Arbitrary File Upload in Siemens Siveillance Control OIS Web Module Leads to Root Access

Siemens has disclosed an unrestricted file upload flaw (CWE-434) in the OIS web module of its Siveillance Control and Siveillance Control Pro building security management platforms. An attacker with low privileges and adjacent network access to the OIS environment can upload arbitrary files to the server. Successful exploitation can escalate to root access on the host system, resulting in a full compromise of the affected OIS environment. All affected branches are covered: Siveillance Control Pro V3.0 before V3.0.12.2173, Control Pro V4.0 before V4.0.9.2178, Control V3.0 before V3.0.22.2177, and Control V4.0 before V4.0.11.2177. There is no known public proof of concept, the issue is not in CISA's KEV catalog, and EPSS currently estimates only a 0.2% chance of exploitation in the next 30 days, indicating no known in-the-wild exploitation.

Do: Upgrade Siveillance Control Pro V3.0 to V3.0.12.2173 or later, Control Pro V4.0 to V4.0.9.2178 or later, Control V3.0 to V3.0.22.2177 or later, and Control V4.0 to V4.0.11.2177 or later. Until patched, restrict network access to the OIS web module to trusted users and segments, since exploitation requires low-privileged access on an adjacent network. Review the OIS host for unexpected files or unusual privilege activity as a precaution.

8.9

<1%

Siemens Siveillance Control Pro V3.0 series: all versions < V3.0.12.2173
Siemens Siveillance Control Pro V4.0 series: all versions < V4.0.9.2178
Siemens Siveillance Control V3.0 series: all versions < V3.0.22.2177
+1 more

CVE-2026-67367

Unauthenticated Directory Traversal File Read in Siemens SIMOVE Fleetmanager and SIPLANT

Siemens SIMOVE Fleetmanager and SIPLANT contain a directory traversal flaw (CWE-23) in the file-serving endpoint of an embedded HTTP server, which fails to validate and neutralize traversal sequences. An unauthenticated remote attacker can send crafted requests containing directory traversal sequences to this endpoint and read arbitrary files from the underlying operating system with no credentials required. Successful exploitation can expose sensitive data such as credential stores, private keys, and configuration secrets, potentially enabling follow-on compromise of the deployment. Affected users are operators running the listed SIMOVE Fleetmanager releases (V3.1 through V4.0 below the fixed versions) and any release of SIPLANT V1.7, V2.2, V3.0, or V3.1 below V3.1.4. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at only 0.8%, so no exploitation is currently known.

Do: Upgrade SIMOVE Fleetmanager to V3.1.13, V3.2.4, V3.3.2, or V4.0.1 or later depending on your release line, and upgrade SIPLANT to V3.1.4 or later; SIPLANT V1.7, V2.2, and V3.0 have no listed fixed version, so check the Siemens ProductCERT advisory for update or migration options. Restrict network access to the embedded HTTP server (e.g., firewall rules or network segmentation) until patched. Because the flaw allows reading credential stores and private keys, review whether sensitive files were reachable on any exposed instance and rotate secrets if compromise is suspected.

9.2

<1%

Siemens SIMOVE Fleetmanager V3.1, all versions < V3.1.13
Siemens SIMOVE Fleetmanager V3.2, all versions < V3.2.4

CVE-2026-7891

Rejected reason: This CVE has been retracted

Rejected reason: This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.

NVD description · AI analysis pending

9.1

<1%

—

May 7, 2026