SIEMENS ProductCERT disclosed two critical vulnerabilities affecting Industrial Edge and Siveillance Open Interface Services (OIS) on 8 September 2026. The flaws carry CVSS scores above 9.0. The first, CVE-2026-18963, resides in the password reset flow of Industrial Edge Management and could let an unauthenticated remote attacker takeover a full user account by resetting credentials without completing email verification.
The second, CVE-2026-50093, affects the Open Interface Services web module in Siveillance Control and Control Pro, potentially allowing an attacker to gain root access on the host system and compromise the OIS environment. Siemens notes no confirmed exploitation at this time, but patches are available and action is advised.
Affected products include the Red Hat build of Keycloak 26.4 and Siemens Siveillance Control Pro V3.0, with the most impactful exposure in Industrial Edge Management Cloud and Pro variants. For CVE-2026-18963, fixes are provided for Cloud (already released) and Pro V1, V2, and Virtual in specific update lines (V1.15.20, V2.2.2, and Virtual V2.9.1). CVE-2026-50093 impacts OIS 3.x and 4.x builds; fixes include Control V3.0.22.2177 and Control Pro V4.0.9.2178. Siemens’ advisories SSA-503852 and SSA-254516 contain the detailed remediation guidance and version information.
Mitigation centres on applying patches and tightening access. Update affected systems to the stated fixed versions and consider blocking direct internet access to affected Industrial Edge instances. Additional measures include deactivating password resets in Keycloak realms or filtering the reset path with a web application firewall, and restricting network access to vulnerable products in line with Siemens’ industrial security guidelines.