September 23, 2026

Keycloak Reset-Credentials Account Takeover Vulnerability in ABB dynovaPRO Energy Management Cloud

Security Advisory Brief

On September 17, 2026, ABB published a cyber security advisory for dynovaPRO, its cloud-hosted energy and charging management platform used to monitor and control electric vehicle chargers, battery energy storage systems, and photovoltaic installations. The advisory addresses CVE-2026-18963, with a CVSS v3.1 score of 9.1, a critical authentication bypass in the Keycloak identity and access management component that dynovaPRO uses for user sign-in. ABB states that every dynovaPRO cloud deployment prior to 2026-08-27 12:00 (CEST) was affected, and that the fix has since been deployed centrally to the cloud service.

The flaw resides in the Keycloak reset-credentials ("Forgot Password") flow. An unauthenticated remote attacker who knows only a target user's email address can request a password reset and then set a new password without ever accessing the verification link sent to that user's mailbox. The attacker can then sign in with the new password and inherit whatever privileges the victim account holds, including the ability to view operational data, change site configuration, and issue control commands to connected energy assets.

The risk context is significant. The underlying Keycloak vulnerability was publicly disclosed in mid-August 2026, and working proof-of-concept exploit code is publicly available. ABB's own log analysis identified 26 password change events across 9 dynovaPRO customers before the fix, which ABB characterizes as possible testing or reconnaissance activity; those accounts were disabled and forced through a password reset. The vulnerability was not listed in the CISA Known Exploited Vulnerabilities catalog as of September 21, 2026. Because the same Keycloak flaw affects any organization running an unpatched Keycloak 26.x server, the exposure extends beyond dynovaPRO to self-hosted identity infrastructure that may front operational and business applications.

Threats and Vulnerabilities

CVE-2026-18963, with a CVSS v3.1 base score of 9.1 (Critical) and a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, is a weak password recovery mechanism (CWE-640) in the keycloak-services component. ABB attributes the root cause to improper token and state validation in the Keycloak password recovery process: crafted HTTP requests to the password reset endpoint, with manipulated session parameters, skip email verification and reach the credential-update step directly. Public analysis of the upstream fix shows that the attack corrupts the reset flow's session state through the "Try Another Way" option and then exploits a missing check that the emailed action token was actually used. ABB lists a temporal score of 8.4 (High), reflecting a functional exploit and an official fix, and an illustrative environmental score of 6.0 (Medium) that each organization should recalculate for its own environment. No CVSS v4.0 score has been published for this CVE. In dynovaPRO, ABB corrected the vulnerable component in the cloud service as of 2026-08-27 12:00 (CEST). For self-hosted deployments, the affected upstream releases are Keycloak 26.0.0 through 26.4.14, 26.5.0 through 26.6.5, and 26.7.0 through 26.7.1, with fixes in 26.4.15, 26.6.6, and 26.7.2; Red Hat build of Keycloak customers should apply the errata listed on Red Hat's CVE page for their product stream. ABB reported no confirmed in-the-wild exploitation as of August 27, 2026, but the 26 suspicious password change events it observed mean affected customers should treat unsolicited reset emails received before the fix date as potential evidence of compromise.

The operational consequence of account takeover is what distinguishes this issue for energy and industrial users. ABB notes that although functional safety systems are separate from dynovaPRO account management, a compromised administrative account could be used to send unauthorized control commands to operational devices such as chargers, batteries, and photovoltaic systems. An attacker holding such an account could alter charging schedules, battery dispatch, or inverter behavior, disrupt site energy management, or harvest site and customer data. The only prerequisite for the attack is a valid user email address, which is frequently discoverable through public sources, making targeted campaigns against facility, fleet, and energy managers straightforward.

Client Impact

Operationally, organizations that manage EV charging infrastructure, battery storage, or on-site solar through dynovaPRO face a risk that an attacker may have held, or may still hold, a valid session with authority over those assets. Unauthorized changes to charge scheduling, storage dispatch, or inverter setpoints can cause service interruption for fleet and customer charging, increased demand charges, loss of backup capacity, or equipment stress. Any user who received an unrequested dynovaPRO password reset email before August 27, 2026 should be treated as a potentially compromised identity until activity on that account has been reviewed. Organizations running their own Keycloak servers face the same account takeover exposure across every application that relies on those servers for sign-in until they apply the upstream fix.

From a compliance perspective, unauthorized access to a cloud platform that can command distributed energy resources is relevant to IEC 62443 access control and account management requirements, and, for entities subject to NERC CIP, to electronic access and incident reporting obligations where such assets fall within scope. Exposure of site, user, and energy consumption data may also trigger privacy and contractual notification duties. Documenting the review of reset emails, account activity, and device command history will support audit evidence that the organization identified and addressed any exposure promptly.

Mitigations

Organizations using ABB dynovaPRO or operating self-hosted Keycloak servers should take the following actions:

Identify every dynovaPRO user who received a password reset email they did not request before 2026-08-27 12:00 (CEST), have each of them reset their password as ABB directs, and review their account activity, recent sign-ins, and configuration or control changes for anything unexpected.
Review dynovaPRO site configurations, charging schedules, battery dispatch settings, and PV or inverter parameters against a known-good baseline, and contact the local ABB service organization if any unauthorized change or unexplained control command is found.
Inventory all self-hosted Keycloak and Red Hat build of Keycloak servers across IT and OT environments and upgrade them to Keycloak 26.4.15, 26.6.6, 26.7.2 or later, or to the fixed Red Hat build of Keycloak errata; until upgraded, disable the reset flow in every realm (Realm settings, Login, Forgot password set to Off), as Red Hat recommends.
Remove Keycloak administrative consoles and identity endpoints from direct internet exposure unless business requirements demand it, and place any necessary exposure behind a reverse proxy or VPN with rate limiting on the password reset endpoint.
Enforce multi-factor authentication for dynovaPRO and Keycloak-backed applications where supported, enable Keycloak event and admin-event logging with forwarding to a central SIEM, and alert on password updates that are not preceded by use of the emailed reset link; after patching, revoke existing sessions for any account reset during the exposure window.

Applying these measures reduces the likelihood that a stolen or reset credential translates into unauthorized control of energy assets and provides the audit record needed to confirm whether exposure occurred.

1898 & Co. Response

1898 & Co. works with energy, utility, and industrial organizations to assess identity and access controls across the cloud platforms and on-premises systems that supervise operational assets. Our teams have experience reviewing single sign-on and identity provider deployments, including Keycloak, for configuration weaknesses, patch status, and internet exposure. We help clients map which cloud-connected energy management platforms can issue commands to chargers, storage, and generation assets, and where those paths cross security zones.

Our threat hunting practice can help clients search email, identity, endpoint, and OT network telemetry for signs that the reset-credentials flaw was used against their users before remediation. This includes correlating unsolicited password reset emails with subsequent sign-ins, reviewing identity provider event logs for resets that bypassed email verification, and examining OT monitoring data for unexpected control activity originating from cloud-connected site gateways. Findings are delivered with prioritized recommendations tied to IEC 62443 and NERC CIP requirements.

1898 & Co. also supports incident response and recovery planning for distributed energy resource environments, helping clients define how compromised cloud accounts are contained, how asset configurations are restored to a verified baseline, and how events are documented for regulators and customers. Organizations that want assistance reviewing their exposure to CVE-2026-18963 can contact their 1898 & Co. representative.

Sources

Cyberthreat