A Password Reset That Skips the Email

Siemens ProductCERT published advisory SSA-503852 on 8 September, describing CVE-2026-18963 in Industrial Edge Management — a flaw in the reset-credentials flow of the bundled Keycloak services component that allows an unauthenticated attacker to force the password reset process for any user without clicking the email verification link the flow is supposed to depend on. The base score is 9.1. Industrial Edge Management Cloud in all versions was fixed on the vendor's side on 2 September; on-premises installations need updating — Pro V1 from the V1.14.9 to V1.15.19 range to V1.15.20 or later, Pro V2 from V2.2.0 or V2.2.1 to V2.2.2, and the Virtual edition from the V2.6.0 to V2.9.0 range to V2.9.1. Where an update cannot be applied immediately, Siemens suggests blocking the reset-credentials login action path at a reverse proxy or web application firewall, removing direct internet exposure, or disabling password reset in the realm settings altogether.

What makes this worth more than a patch note is what the affected product is. Industrial Edge Management is the control plane for an edge fleet: it is how devices are enrolled, how applications are pushed to them, and how configuration reaches the machines those devices are attached to. An authentication bypass there is not equivalent to one on an ordinary web application, because the account being taken over has the standing to deploy software onto industrial hardware.

The underlying defect is also a familiar shape, and one worth recognising in other products. The email verification link in a reset flow is not a convenience; it is the proof that whoever requested the reset controls the address. When the state machine can be advanced without that step — usually because a later endpoint does not re-check what an earlier one established — the entire account recovery mechanism becomes an unauthenticated account takeover primitive. This class of bug appears repeatedly in identity components that are embedded inside larger products, precisely because the embedding vendor inherits the component's behaviour without owning its code.

The practical response has two parts, and the second matters more. Patch, obviously, and treat the cloud fix date as the moment the exposure window closed for that edition rather than for yours. Then ask the question the advisory implies: is this management interface reachable from anywhere it does not need to be? A fleet management console that is internet-facing because a handful of engineers wanted remote access is carrying the full risk of every authentication flaw it will ever have. The mitigations Siemens lists are all forms of the same advice — put the console behind something — and that is worth doing whether or not the current version is patched.