As reported by CISA in advisory ICSA-26-244-06, Rockwell Automation's FactoryTalk Historian Machine Edition (ME) contains two vulnerabilities affecting Series B (v5.202) and Series C (v7.101) deployments. The more severe of the two, CVE-2025-12768, is an out-of-bounds write condition (CWE-787) that permits remote code execution after low-level authentication — a scenario that in operational technology environments often translates to full device compromise.
What elevates this beyond a routine patch cycle is the deployment context. Historian ME sits directly on or adjacent to plant-floor controllers, collecting time-series process data from PLCs and other field devices across chemical manufacturing, food processing, water systems, and healthcare facilities. An attacker who achieves RCE on a Historian ME node isn't just crashing a database — they're positioned on a trusted network segment with line-of-sight to control systems. The adjacent CVE-2026-12661, a stack-based buffer overflow causing denial-of-service, may serve as a complementary tool for attackers looking to blind operators before moving laterally.
Vulnerability Summary
| CVE | Type | CVSS v3.1 | Severity | Impact |
|---|---|---|---|---|
| CVE-2025-12768 | Out-of-bounds Write (CWE-787) | 8.0 | HIGH | Remote Code Execution |
| CVE-2026-12661 | Stack-based Buffer Overflow | 8.0 | HIGH | Denial of Service |
Affected Products: Rockwell Automation Historian ME — Series B v5.202 and Series C v7.101
Authentication Requirement: Low-level authentication required for exploitation, which reduces the attack surface but should not be treated as a meaningful barrier in environments where shared service accounts or weak credentials are common on OT networks.
Patch Status: Rockwell references corrected versions and mitigation guidance via their support portal. No evidence of active exploitation in the wild has been confirmed at time of publication, but the advisory's ICS classification and the involvement of CISA suggest coordinated disclosure has completed and threat actors will have sufficient detail to develop exploits.
Why This Matters Beyond the Patch
The CVSS v3.1 vector string (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) tells an important story: exploitation requires adjacent network access (not internet-facing), but given low complexity and no user interaction. In practice, this means any compromised engineering workstation, jump host, or HMI on the same VLAN as the Historian server becomes a viable launch point. The CVSS v4.0 score of 8.6 for CVE-2025-12768 further underscores the elevated risk profile when considering modern threat scoring methodologies.
Historian ME is not a passive data repository — it runs services that communicate directly with control hardware. RCE here is a stepping stone to process manipulation, not merely data theft.
Who Is Most Exposed
Shield53 Recommendations
Immediate Actions
- Inventory and identify: Locate all Historian ME installations across Series B and C deployments. Confirm version numbers against the affected list (5.202, 7.101).
- Apply vendor patches to corrected versions where available. If patching is delayed due to change-control windows, implement Rockwell's documented mitigations from their security best practices guide.
- Network segmentation: Ensure Historian ME servers reside on isolated VLANs with strict ACLs limiting lateral movement from engineering workstations. Restrict access to only necessary protocols and ports.
- Credential hardening: Since low-level authentication is required for exploitation, rotate and strengthen all service accounts interacting with Historian ME. Eliminate shared credentials between engineering and data collection roles.
- Detection rules: Monitor for anomalous write operations or unexpected process execution originating from Historian ME services. Deploy network IDS signatures for unusual traffic patterns between Historian nodes and PLCs.
- Backup verification: Confirm Historian configuration backups are current and test restoration procedures before applying patches.
Strategic Considerations
Organizations should assess whether Historian ME can be migrated to a network-isolated data collection model where the historian does not share a broadcast domain with any user-accessible systems. This advisory also reinforces the need for continuous OT asset discovery — many organizations cannot accurately enumerate their historian deployments, creating blind spots that attackers exploit first.
