Status: UPDATED
| Advisory ID: CVE-2026-18963
Key Details
| CVE | CVE-2026-18963 |
| CVSS Score / Version | 9.1 (Critical) / CVSS v3.1 |
| Updated | 2026-09-08 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is none. |
| Affected products | Siemens Industrial Edge Management Pro V1, Siemens Industrial Edge Management Pro V2, Siemens Industrial Edge Management Virtual, and Siemens Industrial Edge Management Cloud |
| Classified as | CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) |
Affected Products, Subsystems & Sectors
| Subsystems | General OT |
| Sectors | Multiple |
What to Know
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials. (NVD)
What to Do
Monitor Siemens's web page for any future patch releases.
References