dynovaPRO™ Reset Credentials Vulnerability
ABB is aware of public reports of a vulnerability in the product listed as affected in the advisory. An update has been deployed to the cloud system that resolves a publicly reported vulnerability in the product versions listed above. An attacker who successfully exploited this vulnerability could take remote control of the product. The vulnerability has been identified in the keycloak authentication component which is integrated into dynovaPRO™. The vulnerability exists in the 'Forgot Password' functionality and allows unauthenticated attackers to bypass authentication and hijack user accounts. Users who have received a password reset mail before the mentioned date, without having requested it, are thereby potentially attacked by exploiting this vulnerability. ABB investigated potentially malicious user reset activities and blocked those user access immediately to reduce the exploitation risk. The credentials of those users have been deleted after the software fix was deployed and the users were informed that they must reset their password to gain access to dynovaPRO™ again.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-18963US | — | Exploit | ||
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The iss… | ||||
references
External citations — patches, advisories, analysis.
remediations (3)
- MitigationdynovaPRO™ cloud system < 2026-08-27 12:00 (CEST)
The following conditions reduce the risk of exploitation of this vulnerability: - Limited Attack Surface: The vulnerability is specific to the password reset functionality. Other authentication methods are not affected. - Email Notifications: Legitimate users receive email notifications during password reset attempts, which may alert them to unauthorized access attempts. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- FixeddynovaPRO™ cloud system < 2026-08-27 12:00 (CEST)
The problem is corrected in the dynovaPRO™ cloud system since 2026-08-27 12:00 (CEST). Users who have received a password reset mail without their consent should reset their password to ensure an attacker did not gain access to their account.
- WorkarounddynovaPRO™ cloud system < 2026-08-27 12:00 (CEST)
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”. ABB has implemented temporary mitigation measures for customers: - Password Reset Function disabled: The password reset functionality has been disabled for all dynovaPRO™ customers to prevent exploitation of this vulnerability as a short term step, until software update has been carried out. - Account Monitoring: Users are advised to monitor their user account activity for any unauthorized access. Note: These workarounds do not eliminate the underlying vulnerability until it has been fixed in dynovaPRO™.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan