Threat reportVulnerabilityTL-2026-3518
ICS Patch Tuesday (Oct 2026): Rockwell 1732E ArmorBlock unauthenticated admin takeover (CVE-2026-12655), ABB dynovaPRO / Siemens Industrial Edge Management credential reset bypass (CVE-2026-18963)
ICS Patch Tuesday (Oct 2026) (TL-2026-3518), also tracked as ICS Patch Tuesday October 2026, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-10-14. It has no confirmed attribution, affects Rockwell Automation 1732E ArmorBlock, references 3 CVEs (CVE-2026-12655, CVE-2026-12656, CVE-2026-18963), maps to 6 MITRE ATT&CK techniques (T0814, T1078, T1098), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3518
- Threat ID
- TL-2026-3518
- Also known as
- ICS Patch Tuesday October 2026
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- manufacturing, energy, industrial-automation, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
How ICS Patch Tuesday (Oct 2026) works
Rockwell Automation fixed two unauthenticated flaws in 1732E ArmorBlock (firmware 3.012 and earlier), including CVE-2026-12655 (CVSS 3.1 9.1) that lets a remote attacker change the web server password and take over the admin account. A credential reset bypass tracked as CVE-2026-18963 affects ABB dynovaPRO and Siemens Industrial Edge Management; ABB reports no confirmed exploitation but saw 26 password change events across 9 customers that may indicate testing or reconnaissance.
SecurityWeek's October 2026 ICS Patch Tuesday roundup (2026-10-14) highlights several industrial control system vulnerabilities.
Rockwell Automation 1732E ArmorBlock (advisory SD1801, published 2026-10-13): software version 3.012 and earlier is affected; version 3.013 fixes both flaws. CVE-2026-12655 (CWE-294, CVSS 3.1 9.1, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H; CVSS 4.0 8.8) allows an unauthenticated network attacker to change the device web server password without valid credentials, taking over the admin account. CVE-2026-12656 (CWE-770, CVSS 3.1 7.5, CVSS 4.0 8.7) is a denial of service caused by inadequate handling of network storm traffic; recovery requires a power cycle. Rockwell states no workaround exists beyond applying security best practices on unpatched systems.
CVE-2026-18963 is a flaw in the reset-credentials flow of the keycloak-services component of Red Hat Build of Keycloak (NVD: CVSS 3.1 9.1, CWE-640, published 2026-08-18; a broken step-ordering constraint lets an unauthenticated attacker who knows a username or email reach the password-setting step without completing email verification). Siemens (SSA-503852, published 2026-09-08) lists Industrial Edge Management Cloud, Pro V1, Pro V2 and Virtual as affected by this CVE. ABB published a dynovaPRO advisory titled for CVE-2026-18963 (Reset Credentials Vulnerability, CVSS 3.1 8.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N per the vector links in the document). The ABB advisory text we could extract does not name Keycloak, and affected/fixed dynovaPRO versions could not be extracted, so the Keycloak link for dynovaPRO is an inference from the shared CVE ID and should be confirmed against the ABB advisory. ABB says internal log analysis found 26 password change events affecting 9 customers that may indicate testing or reconnaissance activity, but no confirmed active exploitation.
The same roundup reports Siemens published 17 advisories, including SIMATIC S7-1500 CPUs where more than 400 flaws affect the GNU/Linux subsystem, Industrial Edge devices, Ruggedcom Crossbow SAC, SIMATIC IPC, PSS(R)SINCAL, a .NET client library and Industrial Edge App Publisher. Schneider Electric published two advisories (Pro-face STW6000/Harmony STW6 and Sage RTUs). The article gives no per-CVE details for these, and no public PoC or in-the-wild exploitation statements. No network IOCs (IPs, domains, hashes) were published, so BeaconBeagle correlation was not applicable.
MITRE ATT&CK techniques used in TL-2026-3518
Inhibit Response Function
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
Credential Access
T1212 Exploitation for Credential Access
Reconnaissance
Affected products and versions in ICS Patch Tuesday (Oct 2026)
- Rockwell Automation — 1732E ArmorBlock
Vulnerable versions: 3.012 and earlier
Fixed in: 3.013 - Siemens — Industrial Edge Management Cloud
Vulnerable versions: All versions
Fixed in: Patched 2026-09-02 - Siemens — Industrial Edge Management Pro V1
Vulnerable versions: V1.14.9 to <V1.15.20
Fixed in: V1.15.20 or later - Siemens — Industrial Edge Management Pro V2
Vulnerable versions: V2.2.0 to <V2.2.2
Fixed in: V2.2.2 or later - Siemens — Industrial Edge Management Virtual
Vulnerable versions: V2.6.0 to <V2.9.1
Fixed in: V2.9.1 or later - Red Hat — Red Hat Build of Keycloak (keycloak-services)
Vulnerable versions: 26.4 before 26.4.15-1; 26.6 before 26.6.6-1
Fixed in: 26.4.15-1; 26.6.6-1 - ABB — dynovaPRO
Vulnerable versions: See ABB advisory 4JDE002044
Fixed in: See ABB advisory 4JDE002044
Remediation for ICS Patch Tuesday (Oct 2026)
Patches
- Rockwell 1732E ArmorBlock 3.013 (SD1801)
- Siemens SSA-503852 fixed versions
- Red Hat Build of Keycloak 26.4.15-1 and 26.6.6-1
Immediate actions
- Upgrade Rockwell 1732E ArmorBlock to software version 3.013 or later
- Apply Siemens SSA-503852 fixes: Industrial Edge Management Pro V1 1.15.20+, Pro V2 2.2.2+, Virtual 2.9.1+ (Cloud patched 2026-09-02)
- Apply Red Hat advisories RHSA-2026:56519, 56520, 56523, 56524 for Red Hat Build of Keycloak (26.4.15-1 / 26.6.6-1)
- Review ABB dynovaPRO advisory and audit password change events on dynovaPRO accounts
- Force password resets and revoke sessions for high-value accounts where unexpected password changes are found
Workarounds
- Siemens IEM: block internet access to affected systems
- Siemens IEM: block /auth/realms/customer/login-actions/reset-credentials at the WAF or reverse proxy
- Disable the Keycloak forgot-password / reset credentials function (resetPasswordAllowed=false); this makes password reset unavailable
- Rockwell: no workaround; apply security best practices
Longer-term hardening
- Keep ICS devices and web management interfaces off the internet and behind segmented networks
- Enforce MFA and WAF rate limiting on identity and password-reset endpoints
- Monitor Keycloak events for UPDATE_PASSWORD without a preceding VERIFY_EMAIL
CVEs associated with ICS Patch Tuesday (Oct 2026)
Weaknesses (CWE) in ICS Patch Tuesday (Oct 2026)
Timeline of ICS Patch Tuesday (Oct 2026)
- CVE-2026-18963 (Red Hat Build of Keycloak reset-credentials authentication bypass, CWE-640, CVSS 9.1) published in NVD
- Kudelski Security analysis of CVE-2026-18963 updated; no verified public exploit identified
- Siemens patches Industrial Edge Management Cloud for CVE-2026-18963
- Siemens publishes SSA-503852 for CVE-2026-18963 in Industrial Edge Management with fixed versions and workarounds
- ABB dynovaPRO reset credentials advisory document created (per PDF metadata); reports 26 password change events across 9 customers possibly indicating testing or reconnaissance
- Rockwell Automation publishes SD1801 for 1732E ArmorBlock (CVE-2026-12655, CVE-2026-12656); fix in version 3.013
- SecurityWeek ICS Patch Tuesday roundup reports Siemens 17 advisories, Rockwell ArmorBlock takeover flaw and ABB dynovaPRO advisory
Sources cited for ICS Patch Tuesday (Oct 2026)
- SecurityWeek - ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
- Rockwell Automation Security Advisory SD1801 (1732E ArmorBlock)
- ABB dynovaPRO Cyber Security Advisory - Reset Credentials Vulnerability (CVE-2026-18963)
- NVD - CVE-2026-18963
- Kudelski Security - CVE-2026-18963 Keycloak Credential Reset Authentication Bypass
- Siemens SSA-503852 - Authentication Bypass Vulnerability in Industrial Edge Management
- Siemens ProductCERT
- Schneider Electric Security Notifications
- CISA ICS Advisories
Detection coverage for TL-2026-3518
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3518 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.