Siemens Industrial Edge Management

CVE ID	CVSS Score	Severity	Description
CVE-2026-18963	9.1	critical	CVE-2026-18963. A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Vendor	Product	Asset Type	Purdue Level	Firmware
Siemens	Unknown	rtu	L1	--

Patch: Update to V1.15.20 or later version

Update to V1.15.20 or later version

Mitigation: Deactivate Password Reset in Keycloak Realm Settings Deactivate the password reset functionality dir

Deactivate Password Reset in Keycloak Realm Settings Deactivate the password reset functionality directly within the Keycloak realm settings. To do this, navigate to: Identity & access management > realm settings > Login > Forgot password > Off Please note that by deactivating this setting, the password reset functionality will be unavailable.

Patch: Vulnerability mitigated with firewall rules on 2026-08-26 and fixed with update on 2026-09-02; no us

Vulnerability mitigated with firewall rules on 2026-08-26 and fixed with update on 2026-09-02; no user actions necessary

Patch: Update to V2.2.2 or later version

Update to V2.2.2 or later version

Mitigation: Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to blo

Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.

Mitigation: Configure a Web Application Firewall (WAF) or Reverse Proxy If complete blocking of internet access

Configure a Web Application Firewall (WAF) or Reverse Proxy If complete blocking of internet access is not immediately feasible, you can use a Web Application Firewall (WAF) or a Reverse Proxy to block the affected path. Please configure your WAF or Reverse Proxy to block the following path: /auth/realms/customer/login-actions/reset-credentials Please note that by blocking this path, the password reset functionality will be unavailable.

Patch: Update to V2.9.1 or later version

Update to V2.9.1 or later version

Mitigation: The following conditions reduce the risk of exploitation of this vulnerability: - Limited Attack Su

The following conditions reduce the risk of exploitation of this vulnerability: - Limited Attack Surface: The vulnerability is specific to the password reset functionality. Other authentication methods are not affected. - Email Notifications: Legitimate users receive email notifications during password reset attempts, which may alert them to unauthorized access attempts. Refer to section “General security recommendations” for further advise on how to keep your system secure.

Patch: The problem is corrected in the dynovaPRO™ cloud system since 2026-08-27 12:00 (CEST). Users who ha

The problem is corrected in the dynovaPRO™ cloud system since 2026-08-27 12:00 (CEST). Users who have received a password reset mail without their consent should reset their password to ensure an attacker did not gain access to their account.

Workaround: Workarounds are specific measures that a user can take to help block an attack, for example, tempora

Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”. ABB has implemented temporary mitigation measures for customers: - Password Reset Function disabled: The password reset functionality has been disabled for all dynovaPRO™ customers to prevent exploitation of this vulnerability as a short term step, until software update has been carried out. - Account Monitoring: Users are advised to monitor their user account activity for any unauthorized access. Note: These workarounds do not eliminate the underlying vulnerability until it has been fixed in dynovaPRO™.