Siemens IEM Keycloak Flaw Grants Full Account Takeover
The identity layer for Siemens' industrial edge platform allowed unauthenticated password resets without email verification, CVSS 9.1, and the on-prem fix can't wait.
TL;DR
Siemens Industrial Edge Management contains CVE-2026-18963 (CVSS 9.1), a Keycloak credential-reset flaw that lets an unauthenticated attacker reset any user's password and set new credentials without email verification. IEM Pro V1, Pro V2, and Virtual are affected (patches: V1.15.20, V2.2.2, V2.9.1). IEM Cloud customers were patched server-side, Siemens applied firewall rules August 26 and a fix September 2, no user action needed. For on-prem, the most effective immediate measure is blocking direct internet access entirely.
The vulnerability sits in Keycloak, the open-source identity and access management engine that Red Hat builds and that Siemens embeds in Industrial Edge Management. The reset-credentials flow (the "forgot password" path every user has clicked) didn't actually require the user to click the email verification link before setting new credentials. An attacker who can reach the IEM instance over the network can trigger a password reset for any account and immediately set a new password. No email interception, no user interaction, no privileges required.
That's the CVSS 9.1 critical: network attack vector, low complexity, no privileges, no user interaction. The only constraint is reachability, the attacker needs network access to the IEM instance. That's why Siemens's primary mitigation, blocking direct internet access, is also the most effective one.
For IEM Cloud customers, Siemens handled it quietly. The company applied firewall rules blocking the vulnerable path on August 26, 2026, and deployed a fix on September 2. No customer action required. But for anyone running IEM Pro V1 (≥1.14.9), IEM Pro V2 (≥2.2.0), or IEM Virtual (≥2.6.0) on-premises, the responsibility is theirs. Patches are available: V1.15.20, V2.2.2, and V2.9.1 respectively.
What the practitioner does Monday
If patching today isn't feasible, Siemens offers two intermediate mitigations, both of which disable the password reset function. You can configure a WAF or reverse proxy to block /auth/realms/customer/login-actions/reset-credentials, or deactivate the "Forgot password" setting in the Keycloak realm under Identity & access management > realm settings > Login. The tradeoff is straightforward: no password resets until you patch, but also no account takeovers.
The stakes are higher than a typical IAM compromise because of what IEM manages. Industrial Edge Management is the central platform for onboarding, monitoring, and connecting to Siemens Industrial Edge Devices, the compute units that sit on factory floors and in critical manufacturing environments. An attacker with a hijacked IEM account inherits whatever remote access and device management privileges that account holds.
This is the fourth authentication or authorization bypass disclosed in the IEM product line since 2022. The prior three: improper certificate validation (CVE-2022-40147, CVSS 7.4), authorization bypass through user-controlled keys (CVE-2024-45032, CVSS 10.0), and authentication bypass by primary weakness (CVE-2026-33892, CVSS 7.1). Different mechanisms, same target, the layer that decides who gets in.
Published ·Deep Fathom