← Back to Feed

Rockwell Automation FactoryTalk Activation Manager

CVE-2026-16675

September 1, 2026 · CISA (US-CERT) · Severity: CRITICAL

View CSAF Summary The following versions of Rockwell Automation FactoryTalk Activation Manager are affected: FactoryTalk Activation Manager V5.02_and_below (CVE-2026-16675) CVSS Vendor Equipment Vulnerabilities v3 7.8 Rockwell Automation Rockwell Automation FactoryTalk Activation Manager Improper Restriction of Excessive Authentication Attempts Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-16675 A privilege escalation vulnerability exists within FactoryTalk Activation Manager. The vulnerability stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows credentials could hijack these console windows to obtain a SYSTEM-level command prompt, allowing full access to all files, processes, and system resources. View CVE Details Affected Products Rockwell Automation FactoryTalk Activation Manager Vendor:Rockwell Automation Product Version:Rockwell Automation FactoryTalk Activation Manager V5.02_and_below Product Status:known_affected Remediations Vendor fixRockwell Automation recommends users update to software version V5.03. MitigationCustomers using the affected software who are not able to upgrade to one of the corrected versions should use Rockwell Automation's security best practices. Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4.0 8.5 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Acknowledgments An anonymous security researcher reported this vulnerability to Rockwell Automation, who reported it to CISA Legal Notice and Terms of Use This product is provided subject to this...

Key Takeaways

  • CISA published an advisory for Rockwell Automation FactoryTalk Activation Manager urging users to apply vendor patches and mitigations.
  • The advisory covers 1 vulnerabilities in Rockwell Automation FactoryTalk Activation Manager that require immediate patching.
  • Affected versions of Rockwell Automation FactoryTalk Activation Manager should be updated or isolated to prevent potential compromise by threat actors.
☕ Buy a Coffee