Home / Items
Industrial control advisorySeverity 9.1 critical
Siemens Industrial Edge Management
ICSA-26-265-06 · CISA · September 8, 2026
Summary
Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
From CISA, quoted as published. Check the source before acting.
What to do
Block direct internet access to IEM Pro / IEM Virtual
The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.
Configure a Web Application Firewall (WAF) or Reverse Proxy
If complete blocking of internet access is not immediately feasible, you can use a Web Application Firewall (WAF) or a Reverse Proxy to block the affected path. Please configure your WAF or Reverse Proxy to block the following path:
/auth/realms/customer/login-actions/reset-credentials
Please note that by blocking this path, the password reset functionality will be unavailable.
Deactivate Password Reset in Keycloak Realm Settings
Deactivate the password reset functionality directly within the Keycloak realm settings. To do this, navigate to:
Identity & access management > realm settings > Login > Forgot password > Off
Please note that by deactivating this setting, the password reset functionality will be unavailable.
Update to V1.15.20 or later version
Update to V2.2.2 or later version
Update to V2.9.1 or later version
Vulnerability mitigated with firewall rules on 2026-08-26 and fixed with update on 2026-09-02; no user actions necessary
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-18963 | 9.1 critical | No | 6.6% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Siemens | Industrial Edge Management Cloud |
| Siemens | Industrial Edge Management Pro V1 |
| Siemens | Industrial Edge Management Pro V2 |
| Siemens | Industrial Edge Management Virtual |
Why it's on these mode pages
- Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Change history
- September 8, 2026: Publication Date
- September 22, 2026: Initial CISA Republication of Siemens ProductCERT SSA-503852 advisory
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com