# ICS Patch Tuesday (Oct 2026): Rockwell 1732E ArmorBlock unauthenticated admin takeover (CVE-2026-12655), ABB dynovaPRO / Siemens Industrial Edge Management credential reset bypass (CVE-2026-18963)

> Rockwell Automation fixed two unauthenticated flaws in 1732E ArmorBlock (firmware 3.012 and earlier), including CVE-2026-12655 (CVSS 3.1 9.1) that lets a remote attacker change the web server password and take over the admin account. A credential reset bypass tracked as CVE-2026-18963 affects ABB dynovaPRO and Siemens Industrial Edge Management; ABB reports no confirmed exploitation but saw 26 password change events across 9 customers that may indicate testing or reconnaissance.

- **Published:** 2026-10-14T15:33:16Z
- **Last reviewed:** 2026-10-14T15:33:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3518
- **ID:** TL-2026-3518
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-12655, CVE-2026-12656, CVE-2026-18963

## Description

SecurityWeek's October 2026 ICS Patch Tuesday roundup (2026-10-14) highlights several industrial control system vulnerabilities.

Rockwell Automation 1732E ArmorBlock (advisory SD1801, published 2026-10-13): software version 3.012 and earlier is affected; version 3.013 fixes both flaws. CVE-2026-12655 (CWE-294, CVSS 3.1 9.1, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H; CVSS 4.0 8.8) allows an unauthenticated network attacker to change the device web server password without valid credentials, taking over the admin account. CVE-2026-12656 (CWE-770, CVSS 3.1 7.5, CVSS 4.0 8.7) is a denial of service caused by inadequate handling of network storm traffic; recovery requires a power cycle. Rockwell states no workaround exists beyond applying security best practices on unpatched systems.

CVE-2026-18963 is a flaw in the reset-credentials flow of the keycloak-services component of Red Hat Build of Keycloak (NVD: CVSS 3.1 9.1, CWE-640, published 2026-08-18; a broken step-ordering constraint lets an unauthenticated attacker who knows a username or email reach the password-setting step without completing email verification). Siemens (SSA-503852, published 2026-09-08) lists Industrial Edge Management Cloud, Pro V1, Pro V2 and Virtual as affected by this CVE. ABB published a dynovaPRO advisory titled for CVE-2026-18963 (Reset Credentials Vulnerability, CVSS 3.1 8.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N per the vector links in the document). The ABB advisory text we could extract does not name Keycloak, and affected/fixed dynovaPRO versions could not be extracted, so the Keycloak link for dynovaPRO is an inference from the shared CVE ID and should be confirmed against the ABB advisory. ABB says internal log analysis found 26 password change events affecting 9 customers that may indicate testing or reconnaissance activity, but no confirmed active exploitation.

The same roundup reports Siemens published 17 advisories, including SIMATIC S7-1500 CPUs where more than 400 flaws affect the GNU/Linux subsystem, Industrial Edge devices, Ruggedcom Crossbow SAC, SIMATIC IPC, PSS(R)SINCAL, a .NET client library and Industrial Edge App Publisher. Schneider Electric published two advisories (Pro-face STW6000/Harmony STW6 and Sage RTUs). The article gives no per-CVE details for these, and no public PoC or in-the-wild exploitation statements. No network IOCs (IPs, domains, hashes) were published, so BeaconBeagle correlation was not applicable.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1212 Exploitation for Credential Access
- T1098 Account Manipulation
- T1595 Active Scanning
- T0814 Denial of Service

## Sources

- [SecurityWeek - ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw](https://www.securityweek.com/ics-patch-tuesday-siemens-issues-17-advisories-rockwell-fixes-armorblock-takeover-flaw/)
- [Rockwell Automation Security Advisory SD1801 (1732E ArmorBlock)](https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1801.html)
- [ABB dynovaPRO Cyber Security Advisory - Reset Credentials Vulnerability (CVE-2026-18963)](https://library.e.abb.com/public/ee0d6c723b704ef2b48a11e63fa7442a/4JDE002044_en_pdf_A_dynovaPRO%20Cyber%20Security%20Advisory%20-%20Reset%20Credentials%20Vulnerability%20%28CVE-2026-18963%29.pdf)
- [NVD - CVE-2026-18963](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-18963)
- [Kudelski Security - CVE-2026-18963 Keycloak Credential Reset Authentication Bypass](https://kudelskisecurity.com/research/cve-2026-18963---keycloak-credential-reset-authentication-bypass)
- [Siemens SSA-503852 - Authentication Bypass Vulnerability in Industrial Edge Management](https://cert-portal.siemens.com/productcert/html/ssa-503852.html)
- [Siemens ProductCERT](https://productcert.siemens.com/)
- [Schneider Electric Security Notifications](https://www.se.com/ww/en/work/support/cybersecurity/security-notifications/)
- [CISA ICS Advisories](https://www.cisa.gov/news-events/ics-advisories)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3518