Rockwell FactoryTalk Activation Manager privilege escalation flaw
A local privilege escalation flaw in Rockwell Automation FactoryTalk Activation Manager could let authenticated users hijack SYSTEM-level console windows during install/repair.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an advisory for CVE-2026-16675, a privilege escalation vulnerability affecting Rockwell Automation FactoryTalk Activation Manager versions V5.02 and below. The flaw arises from custom installer actions that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with valid Windows credentials could hijack one of these console windows to obtain a SYSTEM-level command prompt, granting full access to files, processes, and system resources on the host.
The affected product is used in Critical Manufacturing environments worldwide, with Rockwell Automation headquartered in the United States. Rockwell recommends upgrading to version V5.03 to remediate the issue; organizations unable to patch immediately should follow Rockwell's security best practices and CISA's standard ICS mitigation guidance, including network segmentation, isolating control system networks from business networks, and using secure remote access methods such as VPNs. No known public exploitation of this vulnerability has been reported to CISA at this time, and the flaw requires local authenticated access rather than remote exploitation, limiting its immediate risk profile.
Defenders in manufacturing environments running FactoryTalk Activation Manager should prioritize patching to V5.03 and audit local administrative access controls, since exploitation depends on an attacker already possessing valid credentials on the host system.
Mentioned in this report
Detection guidance
FactoryTalk Activation Manager Installer Spawning Interactive Console
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects FactoryTalk Activation Manager installer/repair process spawning visible console windows with elevated privileges - exploitation of CVE-2026-16675. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FactoryTalk Activation Manager Installer Spawning Interactive Console
description: Detects FactoryTalk Activation Manager installer or repair processes
spawning child console windows (cmd.exe, powershell.exe) with SYSTEM privileges.
This behaviour is typical of CVE-2026-16675 privilege escalation exploitation during
installation/repair operations.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: FactoryTalk
ParentCommandLine|contains:
- /install
- /repair
- msiexec
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
filter_legit_admin:
User: SYSTEM
CommandLine|contains:
- /c echo
- /c ping
condition: selection_parent and selection_child and not filter_legit_admin
falsepositives:
- Legitimate FactoryTalk maintenance and repair by authorized administrators
- Software deployment tools orchestrating FactoryTalk updates
level: high
id: 2c7354f3-c755-5401-ac56-01f824cfe2db
status: experimental
author: Vorant
Suspicious Process Elevation via FactoryTalk Custom Installer Action
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects interactive command shell execution with SYSTEM privileges originating from FactoryTalk Activation Manager custom installer actions - CVE-2026-16675 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Process Elevation via FactoryTalk Custom Installer Action
description: Detects instances where cmd.exe or powershell.exe is spawned with SYSTEM
privileges by a FactoryTalk Activation Manager installer process, then creates or
executes child processes - indicating console window hijacking for privilege escalation
(CVE-2026-16675).
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: windows
detection:
selection_installer:
ParentImage|contains: FactoryTalk
User: SYSTEM
selection_console:
Image|endswith:
- \cmd.exe
- \powershell.exe
ParentImage|contains: FactoryTalk
selection_grandchild:
ParentImage|endswith:
- \cmd.exe
- \powershell.exe
Image|endswith:
- \whoami.exe
- \net.exe
- \ipconfig.exe
- \tasklist.exe
condition: selection_installer and selection_console and selection_grandchild
falsepositives:
- Authorized system administrators performing FactoryTalk diagnostics or troubleshooting
- Legitimate scripted FactoryTalk configuration tasks executed by IT operations
level: high
id: d098f4ff-8536-5a84-980d-64a7abab85aa
status: experimental
author: Vorant
FactoryTalk Activation Manager Installation or Repair Triggered Outside Standard MSI Context
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects FactoryTalk Activation Manager installer process spawning with command-line flags typical of manual invocation or repair, potentially indicative of attacker-initiated privilege escalation setup. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FactoryTalk Activation Manager Installation or Repair Triggered Outside Standard
MSI Context
description: Detects FactoryTalk Activation Manager installer execution with /install
or /repair flags initiated by non-system, non-msiexec parent processes - potential
manual trigger for CVE-2026-16675 exploitation.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains: FactoryTalk
CommandLine|contains:
- /install
- /repair
filter_msiexec:
ParentImage|endswith: \msiexec.exe
filter_system:
User: SYSTEM
condition: selection and not filter_msiexec and not filter_system
falsepositives:
- Manual FactoryTalk repair operations initiated by local administrators
- Third-party patch management tools invoking FactoryTalk updates with custom parent
processes
level: medium
id: 4ee87654-21cc-56c6-aab1-2aacea3267d0
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-04
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs