Rockwell Automation FactoryTalk Activation Manager (CVE‑2026‑16675) – Privilege Escalation via Installer Console Windows
What It Is – A privilege‑escalation flaw in FactoryTalk Activation Manager V5.02 and earlier allows an attacker who already possesses valid Windows credentials to hijack a console window launched with SYSTEM privileges during install or repair, gaining full control of the host.
Exploitability – The vulnerability is publicly disclosed (CVE‑2026‑16675) with a CVSS v3 base score of 7.8 (High). No public exploit code has been released, but the attack requires only authenticated access, which is common in managed OT environments.
Affected Products – Rockwell Automation FactoryTalk Activation Manager V5.02 and all prior versions.
Why It Matters for Trust & Control Assurance
- Identity & Access Controls – The flaw bypasses the principle of least privilege, highlighting the need for continuous verification that privileged processes cannot be hijacked.
- Audit‑Ready Evidence – Demonstrating that all installer actions are logged and that privileged sessions are monitored provides defensible evidence during audits or third‑party assessments.
- Supply‑Chain Assurance – Vendors must prove timely patching and secure build pipelines; a delayed update erodes the trust signal that customers demand from critical‑manufacturing suppliers.
Recommended Actions
- Patch Immediately – Upgrade to FactoryTalk Activation Manager V5.03 or later, as recommended by Rockwell Automation.
- Enforce Least‑Privilege Policies – Restrict installer execution to dedicated service accounts without SYSTEM rights; use application control solutions to block unauthorized console spawns.
- Enable Detailed Logging – Capture process‑creation events and console window activity; retain logs for at least 90 days to support incident investigations.
- Validate Credential Hygiene – Rotate Windows service accounts regularly and enforce multi‑factor authentication for any privileged access.
Source: CISA Advisory – ICSA‑26‑244‑04