CISA 2026-09-01

Rockwell Automation FactoryTalk Activation Manager

CVE-2026-16675

Machine-generated analysis · WAYSCloud LLM

FactoryTalk Activation Manager versions 5.02 and earlier are vulnerable to privilege escalation via installer console windows.

Context

The advisory concerns Rockwell Automation FactoryTalk Activation Manager version 5.02 and earlier. It contains a privilege escalation flaw where custom installer actions open visible console windows running with SYSTEM privileges, which an authenticated Windows user could hijack to obtain a SYSTEM-level command prompt. Rockwell Automation recommends upgrading to version V5.03 to remediate the issue.

Operator considerations

Check: Inventory installations of FactoryTalk Activation Manager and verify they are not version 5.02 or earlier.
Isolate: Limit network access to systems running the affected versions until they are updated.
Patch: Apply the vendor-provided update to version V5.03.
Log: Monitor installation and repair logs for unexpected console window activity or elevation attempts.

From Cybersecurity and Infrastructure Security Agency ↗

The following versions of Rockwell Automation FactoryTalk Activation Manager are affected:

FactoryTalk Activation Manager V5.02_and_below (CVE-2026-16675)

Vendor

Equipment

Rockwell Automation

Rockwell Automation FactoryTalk Activation Manager

Improper Restriction of Excessive Authentication Attempts

Critical Infrastructure Sectors: Critical Manufacturing

Countries/Areas Deployed: Worldwide

Company Headquarters Location: United States

A privilege escalation vulnerability exists within FactoryTalk Activation Manager. The vulnerability stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows credentials could hijack these console windows to obtain a SYSTEM-level command prompt, allowing full access to all files, processes, and system resources.

R...

Read the full advisory on CISA →