CISA Advisories Privilege Escalation Flaw in Rockwell Automation FactoryTalk Activation Manager

The US Cybersecurity and Infrastructure Security Agency (CISA) has published Industrial Control Systems advisory ICSA-26-244-04, identifying a privilege escalation vulnerability in Rockwell Automation FactoryTalk Activation Manager. The vulnerability, assigned CVE-2026-16675, affects FactoryTalk Activation Manager versions V5.02 and below.

According to the advisory, the flaw exists within custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker who has obtained Windows credentials could hijack these console windows to obtain a SYSTEM-level command prompt. This would grant the attacker full access to all files, processes, and system resources on the affected host.

Rockwell Automation has rated the vulnerability with CVSS v3 base scores of 7.8 (HIGH) and CVSS v4.0 base scores of 8.5 (HIGH). The vector strings are CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N respectively.

The vulnerability falls under CWE-307 (Improper Restriction of Excessive Authentication Attempts), though the described issue is more accurately characterized as a privilege escalation vector via installer console hijacking.

Rockwell Automation recommends users update to software version V5.03 to remediate the issue. For organizations unable to upgrade immediately, the vendor advises following security best practices to reduce risk. CISA notes that no known public exploitation targeting this vulnerability has been reported at the time of the advisory.

CISA also reiterated general defensive measures for industrial control systems, including minimizing network exposure for control system devices, ensuring systems are not internet-facing, locating control system networks behind firewalls and isolated from business networks, and using secure remote access methods such as VPNs when required.