# Rockwell FactoryTalk Activation Manager privilege escalation flaw

Published: 2026-09-01 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/c52b01ce-9494-5191-bd1a-55e64db864b0/rockwell-factorytalk-activation-manager-privilege-escalation-flaw

> A local privilege escalation flaw in Rockwell Automation FactoryTalk Activation Manager could let authenticated users hijack SYSTEM-level console windows during install/repair.

CISA has published an advisory for CVE-2026-16675, a privilege escalation vulnerability affecting Rockwell Automation FactoryTalk Activation Manager versions V5.02 and below. The flaw arises from custom installer actions that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with valid Windows credentials could hijack one of these console windows to obtain a SYSTEM-level command prompt, granting full access to files, processes, and system resources on the host.

The affected product is used in Critical Manufacturing environments worldwide, with Rockwell Automation headquartered in the United States. Rockwell recommends upgrading to version V5.03 to remediate the issue; organizations unable to patch immediately should follow Rockwell's security best practices and CISA's standard ICS mitigation guidance, including network segmentation, isolating control system networks from business networks, and using secure remote access methods such as VPNs. No known public exploitation of this vulnerability has been reported to CISA at this time, and the flaw requires local authenticated access rather than remote exploitation, limiting its immediate risk profile.

Defenders in manufacturing environments running FactoryTalk Activation Manager should prioritize patching to V5.03 and audit local administrative access controls, since exploitation depends on an attacker already possessing valid credentials on the host system.

## Mentioned in this report

- Vulnerabilities: CVE-2026-16675

## Detection guidance (public sample)

### FactoryTalk Activation Manager Installer Spawning Interactive Console

ATT&CK: T1548

Detects FactoryTalk Activation Manager installer/repair process spawning visible console windows with elevated privileges - exploitation of CVE-2026-16675. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FactoryTalk Activation Manager Installer Spawning Interactive Console
description: Detects FactoryTalk Activation Manager installer or repair processes
  spawning child console windows (cmd.exe, powershell.exe) with SYSTEM privileges.
  This behaviour is typical of CVE-2026-16675 privilege escalation exploitation during
  installation/repair operations.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: FactoryTalk
    ParentCommandLine|contains:
    - /install
    - /repair
    - msiexec
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
  filter_legit_admin:
    User: SYSTEM
    CommandLine|contains:
    - /c echo
    - /c ping
  condition: selection_parent and selection_child and not filter_legit_admin
falsepositives:
- Legitimate FactoryTalk maintenance and repair by authorized administrators
- Software deployment tools orchestrating FactoryTalk updates
level: high
id: 2c7354f3-c755-5401-ac56-01f824cfe2db
status: experimental
author: Vorant
```

### Suspicious Process Elevation via FactoryTalk Custom Installer Action

ATT&CK: T1548

Detects interactive command shell execution with SYSTEM privileges originating from FactoryTalk Activation Manager custom installer actions - CVE-2026-16675 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Process Elevation via FactoryTalk Custom Installer Action
description: Detects instances where cmd.exe or powershell.exe is spawned with SYSTEM
  privileges by a FactoryTalk Activation Manager installer process, then creates or
  executes child processes - indicating console window hijacking for privilege escalation
  (CVE-2026-16675).
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
  category: process_creation
  product: windows
detection:
  selection_installer:
    ParentImage|contains: FactoryTalk
    User: SYSTEM
  selection_console:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    ParentImage|contains: FactoryTalk
  selection_grandchild:
    ParentImage|endswith:
    - \cmd.exe
    - \powershell.exe
    Image|endswith:
    - \whoami.exe
    - \net.exe
    - \ipconfig.exe
    - \tasklist.exe
  condition: selection_installer and selection_console and selection_grandchild
falsepositives:
- Authorized system administrators performing FactoryTalk diagnostics or troubleshooting
- Legitimate scripted FactoryTalk configuration tasks executed by IT operations
level: high
id: d098f4ff-8536-5a84-980d-64a7abab85aa
status: experimental
author: Vorant
```

### FactoryTalk Activation Manager Installation or Repair Triggered Outside Standard MSI Context

ATT&CK: T1548

Detects FactoryTalk Activation Manager installer process spawning with command-line flags typical of manual invocation or repair, potentially indicative of attacker-initiated privilege escalation setup. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FactoryTalk Activation Manager Installation or Repair Triggered Outside Standard
  MSI Context
description: Detects FactoryTalk Activation Manager installer execution with /install
  or /repair flags initiated by non-system, non-msiexec parent processes - potential
  manual trigger for CVE-2026-16675 exploitation.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: FactoryTalk
    CommandLine|contains:
    - /install
    - /repair
  filter_msiexec:
    ParentImage|endswith: \msiexec.exe
  filter_system:
    User: SYSTEM
  condition: selection and not filter_msiexec and not filter_system
falsepositives:
- Manual FactoryTalk repair operations initiated by local administrators
- Third-party patch management tools invoking FactoryTalk updates with custom parent
  processes
level: medium
id: 4ee87654-21cc-56c6-aab1-2aacea3267d0
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c52b01ce-9494-5191-bd1a-55e64db864b0/rockwell-factorytalk-activation-manager-privilege-escalation-flaw.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup