A critical bug in Siemens' Industrial Edge Management let anyone on the internet reset a user's password and take over their account, no verification required.
Siemens disclosed CVE-2026-18963, a CVSS 9.1 authentication bypass affecting Industrial Edge Management Cloud (all versions) and Industrial Edge Management Pro V1 (builds from 1.14.9 through 2.6.0). The flaw lets an unauthenticated remote attacker complete a password reset without finishing email verification, handing over full control of an account. Siemens mitigated the Cloud service with firewall rules on August 26 and shipped a full fix on September 2. Pro V1 users need to update to version 1.15.20, 2.2.2, or 2.9.1, depending on which branch they run; until then, the only workaround is disabling password reset entirely under realm settings.
Industrial Edge Management sits at the center of Siemens' industrial IoT stack, overseeing edge devices on factory floors. A hijacked account here is not just a stolen login. It is a foothold into systems that manage physical industrial processes, which is exactly why the bug scores 9.1 out of 10. The underlying cause, tracked as CWE-640, is a weak password recovery mechanism, a fairly basic mistake for software managing critical infrastructure.
Telling customers to just turn off password reset until they patch is a workaround, not a fix, and a reminder that convenience features in industrial software tend to get less scrutiny than the control systems they sit next to.