Siemens Industrial Edge Management

1. Executive summary

Siemens Industrial Edge Management (IEM) contains an authentication bypass in the Keycloak reset-credentials flow, tracked as CVE-2026-18963, rated CVSS 3.1 9.1 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. An unauthenticated remote attacker can force a password reset for any user without completing the email verification step and set new credentials directly, resulting in full account takeover. Affected deployments are IEM Cloud (all versions), IEM Pro V1 >= V1.14.9 < V1.15.20, IEM Pro V2 >= V2.2.0 < V2.2.2, and IEM Virtual >= V2.6.0 < V2.9.1. No CISA-KEV exploitation state is recorded for this CVE in the verified reference data, so we treat it as unexploited-in-the-wild to date on current evidence. Financial services exposure is indirect: IEM manages edge compute on plant and facility networks, and a takeover of an IEM administrator account gives an attacker a management foothold in OT-adjacent infrastructure.

2. Regulatory framing

No NIS2 or UK NIS article is engaged here on the facts provided. The item is a vendor advisory with no confirmed incident, and the affected product is an industrial edge management platform rather than an identified essential-service component.

3. Technical analysis & attack chain

The vulnerable component is keycloak-services, the core identity and access management engine in Red Hat Build of Keycloak, as embedded in Siemens Industrial Edge Management. The CWE is CWE-640, weak password recovery mechanism for forgotten password.

Confirmed attack chain, as described in the advisory:

1. The attacker reaches an IEM instance over the network. The vector is network, attack complexity low, no privileges and no user interaction required.
2. The attacker invokes the reset-credentials flow at the path /auth/realms/customer/login-actions/reset-credentials.
3. The flaw lets the attacker force the password reset process for any user without clicking the required email verification link.
4. The attacker sets new credentials directly on the target account.
5. The attacker authenticates as the target user and holds full control of that account, including administrative accounts.

The CVSS vector confirms the impact profile: high confidentiality, high integrity, no availability. This is an account takeover primitive, not a crash or code execution primitive. The advisory does not state how the email verification step is bypassed at the protocol level, so the exact request sequence beyond the affected path is not available in the source material. The scope is unchanged (S:U), meaning the impact is contained to the IEM authority granted by the compromised account.

Affected versions, per the CISA advisory:

• Industrial Edge Management Cloud, all versions (CVE-2026-18963)
• Industrial Edge Management Pro V1, >= V1.14.9 and < V1.15.20
• Industrial Edge Management Pro V2, >= V2.2.0 and < V2.2.2
• Industrial Edge Management Virtual, >= V2.6.0 and < V2.9.1

One remediation line in the advisory states that for one deployment the vulnerability was "mitigated with firewall rules on 2026-08-26 and fixed with update on 2026-09-02; no user actions necessary." This reads as Siemens' action on its own hosted environment, most plausibly the IEM Cloud offering, but the advisory does not name which product that line applies to. Treat the Cloud exposure as patched by the vendor as of 2026-09-02, and verify with Siemens if you run IEM Cloud. This is a single-vendor statement; there is no independent corroboration in the source set.

No threat actor attribution appears in any source. No exploitation in the wild is reported, and the verified reference data records no CISA-KEV entry for CVE-2026-18963.

4. Mitigation & containment

P1, within 24 hours:

• Inventory for Siemens Industrial Edge Management instances: IEM Pro V1, IEM Pro V2, IEM Virtual, and any IEM Cloud subscriptions. Record the exact version of each.
• Block direct internet access to every IEM Pro and IEM Virtual instance at the perimeter firewall. Siemens names this the most effective immediate measure.
• Where blocking is not immediately feasible, configure the WAF or reverse proxy to block the path /auth/realms/customer/login-actions/reset-credentials. Note the functional cost: password reset becomes unavailable for users.
• Review authentication logs on IEM instances for password resets completed without a matching email verification click, and for credential changes on administrative accounts, covering the period since deployment. The advisory gives no IOC set, so detection rests on this behavioural review.

P2, within 72 hours:

• Patch. Update IEM Pro V1 to V1.15.20 or later, IEM Pro V2 to V2.2.2 or later, and IEM Virtual to V2.9.1 or later. Updates are delivered through https://iehub.eu1.edge.siemens.cloud/.
• If patching will take longer than the WAF window, disable the password reset function in the Keycloak realm settings as the interim control: Identity & access management > realm settings > Login > Forgot password > Off. This also removes password reset for users, so schedule the patch behind it rather than treating it as the end state.
• For IEM Cloud deployments, confirm with Siemens that the vendor-side fix applied on 2026-09-02 covers your tenant, since the advisory's "no user actions necessary" line is not explicitly scoped to the Cloud product.

P3, within 7 days:

• Apply Siemens' operational guidelines for Industrial Security (https://www.siemens.com/cert/operational-guidelines-industrial-security) to the IEM hosting environment, including network segmentation between the edge management plane and business networks.
• Add IEM version tracking to the asset register so future Siemens SSA advisories can be mapped to deployments without a fresh discovery exercise.
• Where IEM supports functions covered by a DORA ICT third-party assessment, record the patch event and the interim controls against that assessment.

5. Indicators of compromise

No indicators of compromise available in the source material.

The advisory describes no attacker infrastructure, payloads, or artefacts. Detection effort should go to the behavioural review in P1 above.

6. Detection

The source material contains one usable artefact: the affected URL path. The rule below detects requests to the reset-credentials endpoint, which is legitimate user traffic as well as attack traffic, so it is an audit trigger rather than a block signal.

rule Siemens_IEM_CVE_2026_18963_Reset_Credentials_Path
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-22"
        reference = "https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-06"
        description = "Detects requests to the Keycloak reset-credentials path abused by CVE-2026-18963 in Siemens Industrial Edge Management. Matches proxy, WAF or capture traffic containing the path string."
    strings:
        $path = "/auth/realms/customer/login-actions/reset-credentials" ascii
    condition:
        $path
}

title: Siemens IEM CVE-2026-18963 reset-credentials endpoint access
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: >
  Access to the Keycloak reset-credentials path on Siemens Industrial Edge
  Management, the endpoint abused for unauthenticated account takeover in
  CVE-2026-18963. Tune to the IEM hostnames in your estate.
references:

  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-06
author: Adverse Trace
date: 2026/09/22
logsource:
  category: proxy
detection:
  selection:
    http.http_referer|contains: '/auth/realms/customer/login-actions/reset-credentials'
  condition: selection
falsepositives:

  - Legitimate password reset attempts by users
level: medium

The Sigma rule keys on the referer field as a proxy-log approximation; adjust the field to your proxy schema (uri, url, cs-uri-stem) before deployment. No registry, process, or file artefacts exist for this vulnerability, so no host-side rule is possible from the source material.

7. Sources

• CISA, Siemens Industrial Edge Management, ICSA-26-265-06, https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-06, published 2026-09-22 (Siemens ProductCERT SSA-503852, original publication 2026-09-08)

8. Adverse Trace position

We assess this as a high-priority patch for any client running Siemens Industrial Edge Management, on the strength of the CVSS 9.1 CRITICAL rating, the unauthenticated and interactionless nature of the flaw, and the fact that the primitive is full account takeover of a management platform rather than a denial of service. We have no evidence of exploitation in the wild and no CISA-KEV entry, so the urgency is driven by exposure and impact, not observed campaigning; an internet-reachable IEM instance changes that calculation immediately, and the P1 perimeter block should not wait for the patch window. The technical description rests on a single vendor advisory republished by CISA, and the mechanism beyond the affected path is not documented in it, so we are not publishing detection content beyond the endpoint string until an independent write-up or exploit detail emerges. We will track this CVE against CISA-KEV and EPSS, and we will update this advisory if exploitation is confirmed, if the Cloud remediation scope is clarified, or if request-level detail on the verification bypass becomes available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.