CISA Advises Mitigation for Rockwell Automation Historian ME Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-244-06 on September 1, 2026, detailing security flaws in Rockwell Automation FactoryTalk Historian Machine Edition. According to the advisory, CVE-2025-12768 is an out-of-bounds write vulnerability. An attacker with low-level authentication could exploit this to achieve remote code execution on the affected device. The CVSS v3.1 base score for this vulnerability is 8.0, with a vector string of CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high impacts on confidentiality, integrity, and availability.

CVE-2026-12661 is described as a denial-of-service vulnerability. A network-adjacent attacker who is authenticated could send crafted requests to the web interface, resulting in buffer overflow conditions that may cause the device to crash and become unresponsive. The CVSS v3.1 base score for this issue is 4.5, with a vector string of CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, indicating no impact on confidentiality or integrity but high impact on availability.

Rockwell Automation Historian ME Series B version 5.202 and Series C version 7.101 are listed as affected. The vulnerabilities affect critical infrastructure sectors broadly, including Chemical, Critical Manufacturing, Food and Agriculture, Healthcare and Public Health, and Water and Wastewater Systems, with worldwide deployment. Rockwell Automation reported the vulnerabilities to CISA.

Mitigation guidance notes that customers unable to upgrade to corrected versions should follow Rockwell Automation security best practices, accessible via the support portal. CISA recommends minimizing network exposure for control system devices, ensuring they are not internet-accessible, locating control system networks behind firewalls and isolating them from business networks, and using VPNs for any required remote access. As of the advisory publication, no public exploitation was confirmed, but the advisory urges defensive measures to reduce risk.