Full Report
Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versions for the affected products and recommends to update to the latest versions.
Analysis Summary
# Vulnerability: Authentication Bypass in Siemens Industrial Edge Management
## CVE Details
- **CVE ID:** CVE-2026-18963
- **CVSS Score:** 9.1 (Critical)
- **CWE:** CWE-640: Weak Password Recovery Mechanism for Forgotten Password
## Affected Systems
- **Products:**
- Industrial Edge Management Cloud
- Industrial Edge Management Pro (V1 and V2)
- Industrial Edge Management Virtual
- **Versions:**
- **IEM Cloud:** All versions prior to update on 2026-09-02.
- **IEM Pro V1:** All versions >= V1.14.9 < V1.23.0.
- **IEM Pro V2:** All versions >= V2.2.0 < V2.6.2.
- **IEM Virtual:** All versions >= V2.2.0 < V2.6.2.
- **Configurations:** Systems where the "Forgot password" functionality is enabled within the identity management realm settings.
## Vulnerability Description
A critical flaw exists in the `keycloak-services` component, the identity and access management engine used by Siemens Industrial Edge Management. The vulnerability resides in the **reset-credentials flow**, where the system fails to strictly enforce email verification. An unauthenticated remote attacker can bypass the requirement to click a verification link, allowing them to directly set new credentials for any target user account.
## Exploitation
- **Status:** Not explicitly stated as exploited in the wild, but the underlying Keycloak flaw is well-documented.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full account access)
- **Integrity:** High (Ability to change credentials and system settings)
- **Availability:** None (Though account lockout could be a secondary effect)
## Remediation
### Patches
Siemens recommends updating to the following versions:
- **Industrial Edge Management Cloud:** Update applied automatically on 2026-09-02 (No user action required).
- **Industrial Edge Management Pro V1:** Update to V1.23.0 or later.
- **Industrial Edge Management Pro V2:** Update to V2.6.2 or later.
- **Industrial Edge Management Virtual:** Update to V2.6.2 or later.
### Workarounds
If updates cannot be applied immediately, Siemens suggests the following mitigation:
- **Disable Password Reset:** Navigate to `Settings > realm settings > Login > Forgot password` and set to **Off**. Note: This disables the password recovery feature for all users.
- **Network Segmentation:** Ensure the Management platform is protected by firewalls and not exposed to untrusted networks.
## Detection
- **Indicators of Compromise:** Monitor logs for unusual password reset activities, specifically successful resets that do not correlate with legitimate user email verification clicks.
- **Detection methods:** Audit Keycloak/IAM logs for "reset password" events originating from unexpected IP addresses or occurring in rapid succession.
## References
- **Vendor Advisory:** hxxps://cert-portal.siemens[.]com/productcert/html/ssa-503852.html
- **Siemens Industrial Security Guidelines:** hxxps://www.siemens[.]com/cert/operational-guidelines-industrial-security
- **Siemens ProductCERT:** hxxps://www.siemens[.]com/cert/advisories