# Rockwell FactoryTalk Historian flaws enable auth bypass, DoS

Published: 2026-06-18 · Severity: high · Sectors: manufacturing
Canonical: https://vorant.io/reports/6cc18d10-7188-5e57-b90d-55c909bb3d2e/rockwell-factorytalk-historian-flaws-enable-auth-bypass-dos

> Three vulnerabilities in Rockwell Automation FactoryTalk Historian Site Edition allow authentication bypass via race condition and authenticated denial-of-service attacks against critical manufacturing systems.

CISA disclosed three vulnerabilities affecting Rockwell Automation FactoryTalk Historian Site Edition version 11 and earlier, deployed in critical manufacturing environments worldwide. CVE-2025-13036 is an authentication bypass stemming from a race condition that allows attackers to obtain valid authentication tokens by repeatedly sending requests to the login endpoint. CVE-2025-44019 and CVE-2025-36539 are uncaught exception vulnerabilities that permit authenticated users to crash PI Data Archive subsystems, resulting in denial of service and potential data loss from snapshots or write cache.

Rockwell Automation has released patch BF32850 for CVE-2025-13036 and recommends monitoring and automatic restart configuration for the DoS vulnerabilities. Workarounds include restricting port 5450 access to trusted systems and implementing PI System security best practices. No public exploitation has been reported to CISA at this time. The vulnerabilities impact industrial control systems in critical manufacturing sectors, requiring prompt remediation by affected organizations.

## Mentioned in this report

- Vulnerabilities: CVE-2025-13036, CVE-2025-36539, CVE-2025-44019

## Detection guidance (public sample)

### Repeated Authentication Requests to PI Data Archive Login Endpoint (Possible Race-Condition Auth Bypass)

ATT&CK: T1190

Detects bursts of connection attempts to the FactoryTalk Historian / PI Data Archive service port (5450) consistent with the CVE-2025-13036 race-condition token theft technique. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Repeated Connections to PI Data Archive Service Port
id: d4d703ae-df70-56f4-8856-ba408703d4af
status: experimental
description: 'Detects multiple rapid connection attempts to TCP/5450, the FactoryTalk
  Historian/PI Data Archive service port. CVE-2025-13036 allows an attacker to bypass
  authentication by repeatedly sending login requests to trigger a race condition
  and obtain a valid token. A high volume of short-lived connections from a single
  source to this port in a short window is indicative of this exploitation attempt;
  correlate with connection-rate thresholds in your SIEM (e.g. >20 connections from
  one source within 60 seconds) as this cannot be expressed natively in Sigma.

  '
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 5450
    Initiated: 'true'
  filter:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter
falsepositives:
- Legitimate PI System client applications polling the Historian service frequently
- Load balancers or health-check monitors probing the service port
level: medium
```

### Anomalous Connection Volume to PI Data Archive Service Port (Potential DoS)

ATT&CK: T1498

Detects an unusual spike of connections/traffic to the PI Data Archive service port 5450 that may indicate an attempt to exploit uncaught exception DoS vulnerabilities (CVE-2025-44019, CVE-2025-36539). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: High Volume Traffic to PI Data Archive Port 5450
id: d2d11546-35b6-52f1-bc23-6b82260851ee
status: experimental
description: 'Detects network traffic targeting TCP/5450 (PI Data Archive / FactoryTalk
  Historian). Uncaught exception vulnerabilities (CVE-2025-44019, CVE-2025-36539)
  can be triggered by sending crafted authenticated requests that crash the subsystem,
  causing denial of service. A sustained increase in connections or repeated reconnections
  to this port from authenticated or unauthenticated sources may indicate exploitation
  attempts; apply a rate/count threshold (e.g. connection bursts exceeding baseline
  by 3x within 5 minutes) in the SIEM correlation layer since Sigma cannot express
  aggregation thresholds.

  '
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1498
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 5450
  filter:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter
falsepositives:
- Normal historian client polling from multiple engineering workstations
- Scheduled batch data collection jobs connecting to the archive service
level: medium
```

### PI Data Archive Subsystem Crash Event Following Client Request

ATT&CK: T1498

Detects Windows Application Error / crash events for PI Data Archive related processes, which may indicate successful exploitation of an uncaught exception DoS vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PI Data Archive Process Crash Logged in Windows Application Event Log
id: 5c7bd7f5-25f6-5bc3-afa6-0ced41c3030c
status: experimental
description: 'Detects application crash/error events for PI Data Archive or related
  FactoryTalk Historian subsystem processes recorded in the Windows Application event
  log. CVE-2025-44019 and CVE-2025-36539 allow authenticated attackers to send crafted
  requests that trigger uncaught exceptions, crashing the service and causing data
  loss and denial of service.

  '
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1498
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    EventID: 1000
  keyword_filter:
    Data|contains:
    - pisubsys
    - pinetmgr
    - piarchss
    - FactoryTalk Historian
  condition: selection and keyword_filter
falsepositives:
- Unrelated third-party application crashes sharing generic Application Error event
  ID
- Crashes caused by legitimate software bugs or resource exhaustion unrelated to exploitation
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6cc18d10-7188-5e57-b90d-55c909bb3d2e/rockwell-factorytalk-historian-flaws-enable-auth-bypass-dos.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup