AzeoTech DAQFactory type confusion flaw enables code execution
A type confusion vulnerability in AzeoTech DAQFactory ≤21.1 allows attackers to execute arbitrary code via malicious .ctl files, affecting critical manufacturing worldwide.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has disclosed a type confusion vulnerability (CVE-2026-12390) in AzeoTech DAQFactory versions 21.1 and prior that affects critical manufacturing infrastructure worldwide. The vulnerability can be exploited through specially crafted .ctl control files, potentially leading to arbitrary code execution on affected systems. The flaw requires local access and user interaction, as attackers must convince users to open malicious .ctl files.
AzeoTech has not released a patch for this vulnerability. Instead, CISA recommends several mitigation strategies including avoiding documents from untrusted sources, storing .ctl files in admin-only writable folders, operating in Safe Mode when loading external documents, and applying document editing passwords. Organizations are also advised to implement standard ICS security practices such as network segmentation and limiting remote access.
The vulnerability was independently reported by Rocco Calvi of TecSecurity and rgod of Trend Micro's Zero Day Initiative. CISA notes that no public exploitation targeting this vulnerability has been reported at this time, and the flaw is not remotely exploitable without user interaction.
Mentioned in this report
Detection guidance
DAQFactory Spawning Unexpected Child Process After Loading .ctl File
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects DAQFactory.exe spawning command interpreters or scripting engines shortly after launch, consistent with exploitation of the CVE-2026-12390 type confusion flaw via a malicious .ctl control file leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DAQFactory Spawning Suspicious Child Process
id: 00ea72cb-021f-5183-a390-222f8c9d5b85
status: experimental
description: 'Detects AzeoTech DAQFactory (DAQFactory.exe) spawning command-line interpreters
or scripting hosts as a child process. This behaviour is consistent with exploitation
of CVE-2026-12390, a type confusion vulnerability triggered by opening a specially
crafted .ctl control file that leads to arbitrary code execution.
'
references:
- CVE-2026-12390
author: Vorant
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \DAQFactory.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \wscript.exe
- \cscript.exe
condition: selection
falsepositives:
- Administrators using DAQFactory scripting features to legitimately launch external
helper utilities or batch scripts
- Custom DAQFactory quick script actions configured to invoke command-line tools as
part of normal SCADA workflows
level: high
tags:
- attack.t1204.002
- attack.execution
DAQFactory Opening .ctl File From Untrusted or User-Writable Location
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects DAQFactory.exe being launched with a command line referencing a .ctl control file located in commonly abused user-writable directories such as Downloads, Temp, or Desktop, indicating a user opened a potentially malicious control file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DAQFactory Launched With .ctl File From Suspicious Directory
id: 97ce690c-883b-559b-a0fd-f0cc2a3e777d
status: experimental
description: 'Detects DAQFactory.exe process creation where the command line references
a .ctl control file stored in a user-writable or commonly abused directory (e.g.
Downloads, Temp, Desktop). Attackers exploiting CVE-2026-12390 rely on convincing
a user to open a crafted .ctl file, and such files are frequently delivered via
email attachments or downloads landing in these locations.
'
references:
- CVE-2026-12390
author: Vorant
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \DAQFactory.exe
CommandLine|contains: .ctl
suspicious_path:
CommandLine|contains:
- \Downloads\\
- \Temp\\
- \AppData\Local\Temp\\
- \Desktop\\
- \Users\Public\\
condition: selection and suspicious_path
falsepositives:
- Engineers intentionally testing or sharing .ctl configuration files via their Downloads
or Desktop folder as part of normal deployment workflows
- IT staff distributing legitimate .ctl files through shared temp directories during
system commissioning
level: medium
tags:
- attack.t1204.002
- attack.execution
Suspicious .ctl Control File Dropped by Browser or Email Client
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of .ctl files by web browsers or email/archive client processes, indicating a control file for DAQFactory was delivered via web download or email attachment and may require the user to open it to trigger CVE-2026-12390. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: CTL File Dropped By Browser Or Email Client
id: eae9e7f6-9e00-52a8-9c13-8dd474b3e614
status: experimental
description: 'Detects .ctl files being written to disk by web browser or email client
processes. This pattern is a common delivery precursor to exploitation of CVE-2026-12390
in AzeoTech DAQFactory, where a user must be convinced to open a specially crafted
.ctl control file.
'
references:
- CVE-2026-12390
author: Vorant
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: .ctl
Image|endswith:
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \outlook.exe
- \thunderbird.exe
filter:
TargetFilename|contains:
- \Windows\System32\\
- \Program Files\\
condition: selection and not filter
falsepositives:
- Legitimate download or receipt of unrelated .ctl configuration files unrelated to
DAQFactory (e.g. driver control files)
- Software installers or update packages that legitimately place .ctl files during
installation
level: low
tags:
- attack.t1204.002
- attack.execution
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-02
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs