AzeoTech DAQFactory type confusion flaw enables code execution
A type confusion vulnerability in AzeoTech DAQFactory ≤21.1 allows attackers to execute arbitrary code via malicious .ctl files, affecting critical manufacturing worldwide.
CISA has disclosed a type confusion vulnerability (CVE-2026-12390) in AzeoTech DAQFactory versions 21.1 and prior that affects critical manufacturing infrastructure worldwide. The vulnerability can be exploited through specially crafted .ctl control files, potentially leading to arbitrary code execution on affected systems. The flaw requires local access and user interaction, as attackers must convince users to open malicious .ctl files.
AzeoTech has not released a patch for this vulnerability. Instead, CISA recommends several mitigation strategies including avoiding documents from untrusted sources, storing .ctl files in admin-only writable folders, operating in Safe Mode when loading external documents, and applying document editing passwords. Organizations are also advised to implement standard ICS security practices such as network segmentation and limiting remote access.
The vulnerability was independently reported by Rocco Calvi of TecSecurity and rgod of Trend Micro's Zero Day Initiative. CISA notes that no public exploitation targeting this vulnerability has been reported at this time, and the flaw is not remotely exploitable without user interaction.
Mentioned in this report
Detection guidance
DAQFactory Spawning Unexpected Child Process After Loading .ctl File
Detects DAQFactory.exe spawning command interpreters or scripting engines shortly after launch, consistent with exploitation of the CVE-2026-12390 type confusion flaw via a malicious .ctl control file leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DAQFactory Spawning Suspicious Child Process
id: 00ea72cb-021f-5183-a390-222f8c9d5b85
status: experimental
description: 'Detects AzeoTech DAQFactory (DAQFactory.exe) spawning command-line interpreters
or scripting hosts as a child process. This behaviour is consistent with exploitation
of CVE-2026-12390, a type confusion vulnerability triggered by opening a specially
crafted .ctl control file that leads to arbitrary code execution.
'
references:
- CVE-2026-12390
author: Vorant
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \DAQFactory.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \wscript.exe
- \cscript.exe
condition: selection
falsepositives:
- Administrators using DAQFactory scripting features to legitimately launch external
helper utilities or batch scripts
- Custom DAQFactory quick script actions configured to invoke command-line tools as
part of normal SCADA workflows
level: high
tags:
- attack.t1204.002
- attack.execution
DAQFactory Opening .ctl File From Untrusted or User-Writable Location
Detects DAQFactory.exe being launched with a command line referencing a .ctl control file located in commonly abused user-writable directories such as Downloads, Temp, or Desktop, indicating a user opened a potentially malicious control file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DAQFactory Launched With .ctl File From Suspicious Directory
id: 97ce690c-883b-559b-a0fd-f0cc2a3e777d
status: experimental
description: 'Detects DAQFactory.exe process creation where the command line references
a .ctl control file stored in a user-writable or commonly abused directory (e.g.
Downloads, Temp, Desktop). Attackers exploiting CVE-2026-12390 rely on convincing
a user to open a crafted .ctl file, and such files are frequently delivered via
email attachments or downloads landing in these locations.
'
references:
- CVE-2026-12390
author: Vorant
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \DAQFactory.exe
CommandLine|contains: .ctl
suspicious_path:
CommandLine|contains:
- \Downloads\\
- \Temp\\
- \AppData\Local\Temp\\
- \Desktop\\
- \Users\Public\\
condition: selection and suspicious_path
falsepositives:
- Engineers intentionally testing or sharing .ctl configuration files via their Downloads
or Desktop folder as part of normal deployment workflows
- IT staff distributing legitimate .ctl files through shared temp directories during
system commissioning
level: medium
tags:
- attack.t1204.002
- attack.execution
Suspicious .ctl Control File Dropped by Browser or Email Client
Detects creation of .ctl files by web browsers or email/archive client processes, indicating a control file for DAQFactory was delivered via web download or email attachment and may require the user to open it to trigger CVE-2026-12390. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: CTL File Dropped By Browser Or Email Client
id: eae9e7f6-9e00-52a8-9c13-8dd474b3e614
status: experimental
description: 'Detects .ctl files being written to disk by web browser or email client
processes. This pattern is a common delivery precursor to exploitation of CVE-2026-12390
in AzeoTech DAQFactory, where a user must be convinced to open a specially crafted
.ctl control file.
'
references:
- CVE-2026-12390
author: Vorant
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: .ctl
Image|endswith:
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \outlook.exe
- \thunderbird.exe
filter:
TargetFilename|contains:
- \Windows\System32\\
- \Program Files\\
condition: selection and not filter
falsepositives:
- Legitimate download or receipt of unrelated .ctl configuration files unrelated to
DAQFactory (e.g. driver control files)
- Software installers or update packages that legitimately place .ctl files during
installation
level: low
tags:
- attack.t1204.002
- attack.execution
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-02
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free