CISA flags Rockwell Automation flaw in FactoryTalk Activation Manager

CISA issued an advisory on Sept. 1 about a privilege-escalation vulnerability in Rockwell Automation’s FactoryTalk Activation Manager, affecting version V5.02 and earlier.

The advisory says the flaw could allow an authenticated attacker with Windows credentials to hijack visible console windows created during installation or repair and obtain a SYSTEM-level command prompt. CISA said that could give the attacker full access to files, processes and system resources on the affected machine.

CISA listed the product as deployed worldwide and tied to the critical manufacturing sector. The agency gave the issue severity scores of 7.8 under CVSS v3.1 and 8.5 under CVSS v4.0.

CISA identified the issue as CVE-2026-16675 and listed the relevant weakness as CWE-307, or improper restriction of excessive authentication attempts. The agency said the affected product is Rockwell Automation FactoryTalk Activation Manager and that the vendor is headquartered in the United States.

According to the advisory, the vulnerability stems from installer custom actions that spawn visible console windows running with SYSTEM privileges. CISA said an authenticated attacker could target those windows during installation or repair operations.

Rockwell Automation’s remediation is to update to FactoryTalk Activation Manager V5.03. If upgrading is not possible, the advisory says users should follow Rockwell Automation’s security best practices.

CISA said no known public exploitation specifically targeting the vulnerability has been reported to the agency at this time. It also said the issue was reported to Rockwell Automation by an anonymous security researcher, and then reported to CISA.

CISA’s advisory was initially released on Sept. 1.

Sources

• CISA advisory page

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.