Rockwell FactoryTalk Activation Manager privilege escalation flaw
A local privilege escalation flaw in Rockwell Automation FactoryTalk Activation Manager could let authenticated users hijack SYSTEM-level console windows during install/repair.
CISA has published an advisory for CVE-2026-16675, a privilege escalation vulnerability affecting Rockwell Automation FactoryTalk Activation Manager versions V5.02 and below. The flaw arises from custom installer actions that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with valid Windows credentials could hijack one of these console windows to obtain a SYSTEM-level command prompt, granting full access to files, processes, and system resources on the host.
The affected product is used in Critical Manufacturing environments worldwide, with Rockwell Automation headquartered in the United States. Rockwell recommends upgrading to version V5.03 to remediate the issue; organizations unable to patch immediately should follow Rockwell's security best practices and CISA's standard ICS mitigation guidance, including network segmentation, isolating control system networks from business networks, and using secure remote access methods such as VPNs. No known public exploitation of this vulnerability has been reported to CISA at this time, and the flaw requires local authenticated access rather than remote exploitation, limiting its immediate risk profile.
Defenders in manufacturing environments running FactoryTalk Activation Manager should prioritize patching to V5.03 and audit local administrative access controls, since exploitation depends on an attacker already possessing valid credentials on the host system.
Mentioned in this report
Detection guidance
FactoryTalk Activation Manager Installer Spawning Interactive Console
Detects FactoryTalk Activation Manager installer/repair process spawning visible console windows with elevated privileges - exploitation of CVE-2026-16675. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FactoryTalk Activation Manager Installer Spawning Interactive Console
description: Detects FactoryTalk Activation Manager installer or repair processes
spawning child console windows (cmd.exe, powershell.exe) with SYSTEM privileges.
This behaviour is typical of CVE-2026-16675 privilege escalation exploitation during
installation/repair operations.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: FactoryTalk
ParentCommandLine|contains:
- /install
- /repair
- msiexec
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
filter_legit_admin:
User: SYSTEM
CommandLine|contains:
- /c echo
- /c ping
condition: selection_parent and selection_child and not filter_legit_admin
falsepositives:
- Legitimate FactoryTalk maintenance and repair by authorized administrators
- Software deployment tools orchestrating FactoryTalk updates
level: high
id: 2c7354f3-c755-5401-ac56-01f824cfe2db
status: experimental
author: Vorant
Suspicious Process Elevation via FactoryTalk Custom Installer Action
Detects interactive command shell execution with SYSTEM privileges originating from FactoryTalk Activation Manager custom installer actions - CVE-2026-16675 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Process Elevation via FactoryTalk Custom Installer Action
description: Detects instances where cmd.exe or powershell.exe is spawned with SYSTEM
privileges by a FactoryTalk Activation Manager installer process, then creates or
executes child processes - indicating console window hijacking for privilege escalation
(CVE-2026-16675).
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: windows
detection:
selection_installer:
ParentImage|contains: FactoryTalk
User: SYSTEM
selection_console:
Image|endswith:
- \cmd.exe
- \powershell.exe
ParentImage|contains: FactoryTalk
selection_grandchild:
ParentImage|endswith:
- \cmd.exe
- \powershell.exe
Image|endswith:
- \whoami.exe
- \net.exe
- \ipconfig.exe
- \tasklist.exe
condition: selection_installer and selection_console and selection_grandchild
falsepositives:
- Authorized system administrators performing FactoryTalk diagnostics or troubleshooting
- Legitimate scripted FactoryTalk configuration tasks executed by IT operations
level: high
id: d098f4ff-8536-5a84-980d-64a7abab85aa
status: experimental
author: Vorant
FactoryTalk Activation Manager Installation or Repair Triggered Outside Standard MSI Context
Detects FactoryTalk Activation Manager installer process spawning with command-line flags typical of manual invocation or repair, potentially indicative of attacker-initiated privilege escalation setup. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FactoryTalk Activation Manager Installation or Repair Triggered Outside Standard
MSI Context
description: Detects FactoryTalk Activation Manager installer execution with /install
or /repair flags initiated by non-system, non-msiexec parent processes - potential
manual trigger for CVE-2026-16675 exploitation.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains: FactoryTalk
CommandLine|contains:
- /install
- /repair
filter_msiexec:
ParentImage|endswith: \msiexec.exe
filter_system:
User: SYSTEM
condition: selection and not filter_msiexec and not filter_system
falsepositives:
- Manual FactoryTalk repair operations initiated by local administrators
- Third-party patch management tools invoking FactoryTalk updates with custom parent
processes
level: medium
id: 4ee87654-21cc-56c6-aab1-2aacea3267d0
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-04
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free