CVE-2026-18963
criticalpriority · track · 12EPSS 0.064 · 94 %ileexploit · PoCCHDENLRUUSEPSS · scored 2026-10-22
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixeddynovaPRO™ cloud system < 2026-08-27 12:00 (CEST)abb_psirt
The problem is corrected in the dynovaPRO™ cloud system since 2026-08-27 12:00 (CEST). Users who have received a password reset mail without their consent should reset their password to ensure an attacker did not gain access to their account.
- FixedIndustrial Edge Management Cloudsiemens_psirt
Vulnerability mitigated with firewall rules on 2026-08-26 and fixed with update on 2026-09-02; no user actions necessary
- FixedIndustrial Edge Management Pro V1siemens_psirt
Update to V1.15.20 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management Pro V2siemens_psirt
Update to V2.2.2 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management Virtualsiemens_psirt
Update to V2.9.1 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management Cloudcisa_csaf_ot
Vulnerability mitigated with firewall rules on 2026-08-26 and fixed with update on 2026-09-02; no user actions necessary
- FixedIndustrial Edge Management Pro V1cisa_csaf_ot
Update to V1.15.20 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management Pro V2cisa_csaf_ot
Update to V2.2.2 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management Virtualcisa_csaf_ot
Update to V2.9.1 or later version
https://iehub.eu1.edge.siemens.cloud/ - MitigationdynovaPRO™ cloud system < 2026-08-27 12:00 (CEST)abb_psirt
The following conditions reduce the risk of exploitation of this vulnerability: - Limited Attack Surface: The vulnerability is specific to the password reset functionality. Other authentication methods are not affected. - Email Notifications: Legitimate users receive email notifications during password reset attempts, which may alert them to unauthorized access attempts. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationIndustrial Edge Management Cloudsiemens_psirt
Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.
- MitigationIndustrial Edge Management Pro V1siemens_psirt
Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.
- MitigationIndustrial Edge Management Pro V2siemens_psirt
Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.
- MitigationIndustrial Edge Management Virtualsiemens_psirt
Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.
- MitigationIndustrial Edge Management Cloudcisa_csaf_ot
Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.
- MitigationIndustrial Edge Management Pro V1cisa_csaf_ot
Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.
- MitigationIndustrial Edge Management Pro V2cisa_csaf_ot
Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.
- MitigationIndustrial Edge Management Virtualcisa_csaf_ot
Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.
- WorkarounddynovaPRO™ cloud system < 2026-08-27 12:00 (CEST)abb_psirt
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”. ABB has implemented temporary mitigation measures for customers: - Password Reset Function disabled: The password reset functionality has been disabled for all dynovaPRO™ customers to prevent exploitation of this vulnerability as a short term step, until software update has been carried out. - Account Monitoring: Users are advised to monitor their user account activity for any unauthorized access. Note: These workarounds do not eliminate the underlying vulnerability until it has been fixed in dynovaPRO™.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (19)
Public proof-of-concept and weaponised exploit code.
- EDB-52699Keycloak 26.7.2 - Unauthenticated Account TakeoverPoC · exploit_db
- EQSTLab/CVE-2026-18963Keycloak reset-credentials flow bypassPoC · poc_in_github
- Red-Darkin/CVE-2026-18963-keycloakCVE-2026-18963PoC · poc_in_github
affected products (82)
Products and version ranges known to be affected.
advisories (9)
Vendor and ecosystem advisories describing this.
- 4JDE002044dynovaPRO™ Reset Credentials Vulnerability2026-09-17csaf · abb_psirtCH
ABB is aware of public reports of a vulnerability in the product listed as affected in the advisory. An update has been deployed to the cloud system that resolves a publicly reported vulnerability in the product versions listed above. An attacker who successfully exploited this vulnerability could take remote control of the product. The vulnerability has been identified in the keycloak authentication component which is integrated into dynovaPRO™. The vulnerability exists in the 'Forgot Password' functionality and allows unauthenticated attackers to bypass authentication and hijack user accounts. Users who have received a password reset mail before the mentioned date, without having requested it, are thereby potentially attacked by exploiting this vulnerability. ABB investigated potentially malicious user reset activities and blocked those user access immediately to reduce the exploitation risk. The credentials of those users have been deleted after the software fix was deployed and the users were informed that they must reset their password to gain access to dynovaPRO™ again.
- NCSC-2026-0326Kwetsbaarheden verholpen in KeycloakNL2026-08-25csaf · ncsc_nlNL
Red Hat heeft meerdere kwetsbaarheden verholpen in Keycloak.
- NCSC-2026-0346Kwetsbaarheden verholpen in Siemens productenNL2026-09-08csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Desigo, Reyrolle, SIMATIC, SCALANCE, SINAMICS en Siveillance.
- SSA-503852SSA-503852: Authentication Bypass Vulnerability in Industrial Edge Management2026-09-08csaf · siemens_psirtDE
Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- WID-SEC-W-2026-2915Keycloak: Mehrere SchwachstellenDeutsch2026-08-18csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch Benutzerkonten zu übernehmen.
- WID-SEC-W-2026-3461HCL BigFix Service Management: Mehrere SchwachstellenDeutsch2026-09-17csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Sicherheitsmaßnahmen zu umgehen, erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuführen oder serverseitige Request-Forgery- sowie Brute-Force- und Session-Hijacking-Angriffe auszuführen.
- GHSA-4gv3-mc9p-5wqcKeycloak: Unauthenticated account takeover via reset-credentials flow bypass2026-08-18ghsa · osvUS
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
- ICSA-26-265-06Siemens Industrial Edge Management2026-09-08icsa · cisa_csaf_otUS
Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- BIT-keycloak-2026-18963Flaw in the reset-credentials flow of the keycloak-services component2026-08-25vendor · osvUS
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan