← News
/DISPATCH · 2026-09-10

Siemens Discloses Two Critical Vulnerabilities: Unauthenticated Account Takeover in Industrial Edge, Root on Siveillance

Siemens ProductCERT discloses CVE-2026-18963 and CVE-2026-50093, enabling account takeover on Industrial Edge Management and root on Siveillance Control.

Siemens ProductCERT disclosed two critical vulnerabilities with CVSS scores above 9.0 on September 8, affecting Industrial Edge Management and the Siveillance Control product family. The former allows an unauthenticated attacker to fully take over any account. The latter lets an attacker obtain root-level privileges on the security control server. No public PoC or in-the-wild exploitation for either. Given the industrial and critical-site OT environments they serve, Siemens recommends upgrading promptly.

Overview

The first vulnerability, CVE-2026-18963 (CVSS v3.1 9.1), sits in the Industrial Edge Management password-reset flow. Root cause is in the Keycloak identity engine. Siemens security advisory SSA-503852 states that an unauthenticated remote attacker can force a password reset for any user without clicking the email verification link and set new credentials directly, achieving full account takeover.

The second vulnerability, CVE-2026-50093 (CVSS 9.0), is an arbitrary file-upload flaw in the OIS web module of Siveillance Control and Control Pro. An unauthenticated attacker can upload arbitrary files to the server. Successful exploitation yields host root and fully compromises the OIS environment. Affected versions cover all older releases of Siveillance Control Pro V3.0/V4.0 and Control V3.0/V4.0.

Technical Details and Impact

Risk weight comes from where these products sit, not from exploit difficulty. Industrial Edge handles edge compute on plant and industrial networks. Siveillance Control is used for security management at ports, airports, power generation, and other sensitive sites. An attacker who takes over an IEM admin account can push apps and configs to edge nodes. Root on a Siveillance server lets an attacker manipulate incident-handling logic and wipe audit trails—impact well beyond a single device. The OIS web module is enabled by default in some deployments. Neither vulnerability requires user interaction; network reachability is sufficient.

Remediation

Siemens has released fixed versions. Operators should upgrade unit by unit against the product lines:

`Industrial Edge Management (CVE-2026-18963)
  Cloud    → Fixed on September 2, no action required
  Pro V1   → Upgrade to V1.15.20
  Pro V2   → Upgrade to V2.2.2
  Virtual  → Upgrade to V2.9.1

Siveillance Control / Pro (CVE-2026-50093)
  Control Pro V3.0 → V3.0.12.2173
  Control Pro V4.0 → V4.0.9.2178
  Control V3.0     → V3.0.22.2177
  Control V4.0     → V4.0.11.2177`

Environments that cannot upgrade immediately, as temporary mitigation: isolate the IEM management interface and OIS web module from the business network, restrict source IPs, segment and access-control the IT/OT boundary, and audit recent anomalous logins and password-reset events. Siemens' same-batch September advisories also cover Reyrolle 7SR5, Teamcenter, Desigo CC, SIMATIC AX Runtime, and others. Operators in those sectors should check those as well.

References