As reported by CISA in advisory ICSA-26-244-04, Rockwell Automation has disclosed a privilege escalation vulnerability in FactoryTalk Activation Manager (V5.02 and below) that could allow an authenticated attacker to achieve SYSTEM-level access on affected Windows hosts. The flaw, tracked as CVE-2026-16675, carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 score of 8.5 (High).

Security Impact: As reported by CISA in advisory ICSA-26-244-04, Rockwell Automation has disclosed a privilege escalation vulnerability in FactoryTalk Activation Manager (V5.02 and below) that could allow an authenticated attacker to achieve SYSTEM-level access on affected Windows hosts.

Vulnerability Summary

CVECVSS v3.1CVSS v4.0SeverityAffected VersionsPatch AvailableActive Exploitation
CVE-2026-166757.88.5HighFactoryTalk Activation Manager V5.02 and belowYes — upgrade to V5.03Not reported

The vulnerability arises from custom installer actions that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with valid Windows credentials — even a low-privileged standard user — can hijack these console windows to obtain a SYSTEM-level command prompt. This grants full access to all files, processes, and system resources on the host.

Why This Matters

While this vulnerability requires local authentication and is not remotely exploitable, its impact in OT environments is significant. FactoryTalk Activation Manager is deployed across critical manufacturing facilities worldwide and is often installed on engineering workstations, HMI terminals, or servers that may also run other Rockwell automation software. A successful privilege escalation on one of these hosts could serve as a beachhead for lateral movement within the OT network, credential theft, or manipulation of automation project files.

The attack vector — hijacking visible console windows spawned by an MSI installer running as SYSTEM — is a well-known class of Windows privilege escalation that has been documented in security research for years. It is disappointing to see it persist in industrial software, particularly given that mitigations (such as running installer actions silently or with restricted window station access) are well understood. The CWE classification as CWE-307 (Improper Restriction of Excessive Authentication Attempts) in the advisory is somewhat unusual for this attack pattern — the core issue is closer to CWE-426 (Untrusted Search Path) or CWE-427 (Uncontrolled Search Path Element), or more precisely an instance of the classic "installer DLL hijacking / console window hijacking" family.

Who Is Most at Risk

  • Critical manufacturing facilities running FactoryTalk Activation Manager on shared or multi-user engineering workstations where multiple operators have local accounts.
  • Environments with thin client / RDS deployments where operators access FactoryTalk software via Remote Desktop — any authenticated RDS user could potentially exploit this.
  • Systems where software installation is performed by standard users rather than restricted to administrative personnel via controlled deployment tools.
  • Stale or legacy deployments still running V5.02 or earlier without a patch management cycle for non-PLC software.
The requirement for local authentication lowers the likelihood of opportunistic exploitation, but in OT environments where workstation hygiene is often poor and local accounts are shared among shift operators, the practical risk is higher than the CVSS score alone might suggest.

Shield53 Recommendations

Immediate Actions

Shield53 Recommendations
Patch to V5.03 immediately. Download the updated version from Rockwell's support portal and schedule deployment during the next maintenance window. Validate the patch in a test environment before rolling out to production engineering stations.
Restrict local administrative and installation privileges. Ensure that only authorized IT/OT administrators can install or repair software on FactoryTalk hosts. Standard operator accounts should not have permission to trigger MSI repair operations.
Audit who has local accounts on engineering workstations and HMI terminals running FactoryTalk software. Revoke unnecessary accounts and implement least-privilege access controls.
Monitor for exploitation attempts. Deploy detection rules for unexpected cmd.exe or conhost.exe child processes spawned by msiexec.exe running as SYSTEM. Sysmon Event ID 1 (process creation) with parent process msiexec.exe and child cmd.exe is a strong indicator.
Implement application whitelisting (e.g., Windows Defender Application Control / AppLocker) to prevent unauthorized command-line execution from installer-spawned processes.
Network segmentation. Ensure that engineering workstations running FactoryTalk software are not internet-accessible and are segmented from corporate IT networks per CISA ICS best practices.

Broader Implications

This disclosure underscores a persistent gap in OT software supply chain security: installer hygiene. Vendors of industrial software must treat MSI/custom-action code with the same scrutiny as network-facing services. A single poorly written installer action can undermine an entire facility's host hardening strategy. Defenders should pressure vendors for SBOMs that include installer components and should incorporate installer-level privilege escalation checks into their OT security assessments.

Additionally, organizations should inventory all Rockwell software on their OT estate — not just FactoryTalk Activation Manager. Installer-based privilege escalation flaws tend to recur across a vendor's product line when shared installer frameworks or custom action libraries are involved.