Summary
On September 22, 2026, CISA published ICSA-26-265-06 for Siemens Industrial Edge Management. It republishes Siemens advisory SSA-503852 and covers one CVE, CVE-2026-18963.
The flaw is in the password reset flow. An attacker can skip the email verification step and set a new password for any user account. The attacker needs no login and no user action. CVSS v3.1 9.1, vector AV:N/AC:L/PR:N/UI:N.
Industrial Edge Management is the console that deploys and configures apps on the Industrial Edge devices across a site. An administrator account on the console reaches every device it manages.
What the advisory says
- Product: Siemens Industrial Edge Management, in its Pro, Virtual and cloud-hosted forms.
- The flaw: CWE-640, weak password recovery mechanism, in the reset-credentials flow of the Keycloak component. Keycloak is the open-source identity server the product uses for logins.
- Sector: Critical Manufacturing, deployed worldwide.
- Found by: Siemens ProductCERT.
- Known exploitation: not mentioned in the advisory.
| Product | Affected | Fixed version |
|---|---|---|
| Industrial Edge Management Pro V1 | 1.14.9 to before 1.15.20 | 1.15.20 |
| Industrial Edge Management Pro V2 | 2.2.0 to before 2.2.2 | 2.2.2 |
| Industrial Edge Management Virtual | 2.6.0 to before 2.9.1 | 2.9.1 |
| Industrial Edge Management (cloud) | All versions | Mitigated by Siemens on 26 August, fixed on 2 September 2026 |
Siemens lists three workarounds for anyone who cannot update yet:
- Block internet access to the Industrial Edge Management instance.
- On a web application firewall or reverse proxy, block the path
/auth/realms/customer/login-actions/reset-credentials. - Turn off password reset in Keycloak: Identity & access management, realm settings, Login, Forgot password, Off.
Why attackers target the management console
An edge platform lets a central team push software to devices on the plant floor without visiting each one. Industrial Edge devices sit next to the PLCs and collect their data. The management console decides which apps run on the devices and how they are configured.
The console is therefore the most valuable login on the edge side of a plant. An administrator on the console can change the software that runs next to the controllers, on every device at once. This CVE gives that account to anyone who can load the reset page.
What the three workarounds have in common
Each workaround limits access to the reset flow in a different way.
Blocking internet access limits who can reach the console. Blocking the reset path on a proxy limits which pages they can reach on the console. Turning off password reset removes the feature that the flaw affects.
Blocking access is the workaround to keep after the update. The flaw matters because the reset page answers anyone who can send it an HTTP request. If only the few engineers who administer the platform can reach the page, over a path you control and record, very few people can exploit a flaw that comes before the login.
Web consoles will have other flaws that come before the login, with different CVE numbers. The same fix applies to them: only the people who need to log in should be able to reach the login page.
Why teams publish the console on the internet
Teams rarely publish a console on the internet by accident. A central engineering team manages edge devices at five plants. An integrator supports the rollout from their office. Publishing the console is the quickest way to give all of them access.
This CVE puts that setup at the highest risk. A reachable login page is exposed even when every password is strong, because a flaw that comes before the login does not need a password. The central team and the integrator need access for named people to that one console, tied to their identity, recorded, and closed when the job is done. You can keep staff and integrators in separate directories, for example your corporate Active Directory or Entra ID for staff and a second directory for the integrator, with MFA at the access point. Nobody else on the internet needs to reach the console.
Five steps to take this week
- Find every Industrial Edge Management instance, Pro and Virtual, and check whether you use the cloud service. Note the version of each.
- Check who can reach each instance. Test from outside your network. If the login page responds from the internet, fix that today.
- Apply a workaround now if the update needs a maintenance window. Block the reset-credentials path on your proxy, or turn off Forgot password in the Keycloak realm settings.
- Update to 1.15.20, 2.2.2 or 2.9.1 in your normal maintenance window.
- Review the accounts. Look for password resets and new logins since the console was exposed. Remove accounts that belong to people or companies that no longer work on the platform.