Rockwell Automation FactoryTalk Activation Manager: 1 CVE, High 7.8
Summary
CISA reports 1 vulnerability in Rockwell Automation FactoryTalk Activation Manager. Weakness type: Improper Restriction of Excessive Authentication Attempts. Successful exploitation of this vulnerability could allow an authenticated attacker to obtain SYSTEM-level access, granting full control over all files, processes, and system resources. Highest CVSS v3 score: 7.8 (High), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- Rockwell Automation
- Products
- FactoryTalk Activation Manager
- CVEs
- CVE-2026-16675
- Highest CVSS v3
- 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-16675 | Improper Restriction of Excessive Authentication Attempts | 7.8 | – | No | A privilege escalation vulnerability exists within FactoryTalk Activation Manager. The vulnerability stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows credentials could hijack these console windows to obtain a SYSTEM-level command prompt, allowing full access … |
Affected products (1)
- Rockwell Automation FactoryTalk Activation Manager <=V5.02
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Rockwell Automation recommends users update to software version V5.03.
- Mitigation: Customers using the affected software who are not able to upgrade to one of the corrected versions should use Rockwell Automation's security best practices.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.