Siemens Industrial Edge Management Authentication Bypass Vulnerability

Siemens Industrial Edge Management is affected by an authentication bypass vulnerability tracked as CVE-2026-18963. The vulnerability exists in the reset-credentials flow of the keycloak-services component, which manages identity and access for the platform. According to CISA and Siemens advisories, an unauthenticated remote attacker can exploit this weakness to force a password reset for any target user account without requiring the user to click the standard email verification link. Successful exploitation could result in the attacker gaining full control over the compromised account.

The vulnerability has a CVSS v3.1 base score of 9.1, classified as Critical, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Affected product versions include Industrial Edge Management Cloud (all versions), Industrial Edge Management Pro V1 from 1.14.9 up to but not including 1.15.20, Industrial Edge Management Pro V2 from 2.2.0 up to but not including 2.2.2, and Industrial Edge Management Virtual from 2.6.0 up to but not including 2.9.1.

Siemens has addressed the vulnerability through software updates. The vendor recommends updating to Industrial Edge Management Pro V1 version 1.15.20 or later, Pro V2 version 2.2.2 or later, and Virtual version 2.9.1 or later. Additionally, Siemens advises blocking direct internet access to Industrial Edge Management Pro and Virtual instances, or configuring a Web Application Firewall or reverse proxy to block the path /auth/realms/customer/login-actions/reset-credentials. Deactivating the password reset functionality within Keycloak realm settings is also cited as a mitigation option, though this will disable the password reset feature for legitimate users.

The vulnerability was reported to CISA by Siemens ProductCERT. Affected sectors include Critical Manufacturing, with deployments worldwide. No public exploitation has been confirmed at the time of reporting, but the severity of the flaw and the wide version ranges affected warrant prompt attention from organizations using these products.