Industrial control systems sit at the heart of modern critical infrastructure — and they are increasingly in the crosshairs of sophisticated adversaries. A fresh wave of disclosed vulnerabilities in Rockwell Automation's FactoryTalk Historian Site Edition underscores a persistent and troubling reality: the software platforms that aggregate and manage operational data in manufacturing environments carry security debt that attackers are more than willing to exploit.
What's at Stake
Three distinct vulnerabilities have been identified across multiple versions of FactoryTalk Historian SE, a widely deployed data historian platform used in critical manufacturing sectors around the globe. Collectively, these flaws could allow a threat actor to seize a valid authentication token, cripple system availability through denial-of-service conditions, or force an outright system crash — all scenarios with potentially severe downstream consequences in operational technology (OT) environments.
The vulnerabilities carry a CVSS v3 score of 7.7, placing them firmly in the "High" severity band. In ICS environments, where uptime, data integrity, and process continuity are non-negotiable, even a "High" rating demands immediate attention.
Breaking Down the Three Vulnerabilities
Authentication Bypass via Race Condition (CVE-2025-13036)
Perhaps the most alarming of the three, this flaw affects FactoryTalk Historian SE version 11 and stems from a concurrent execution using shared resources with improper synchronization — more commonly known as a race condition. By flooding the login endpoint with rapid, repeated requests, an attacker can exploit the timing gap in the authentication logic to obtain a valid session token without supplying legitimate credentials.
Authentication bypass vulnerabilities are particularly dangerous in ICS contexts. Once an attacker holds a valid token, they inherit the access privileges associated with that session — potentially gaining the ability to read, manipulate, or delete historical process data that operators rely upon for real-time decision-making.
Uncaught Exception Leading to Denial of Service (CVE-2025-44019)
Affecting all versions up to and including 11.00, this vulnerability involves an uncaught exception that, when triggered, can render the historian service unavailable. In manufacturing environments, a historian going offline doesn't just mean lost data — it means blind spots in process monitoring, potential regulatory compliance gaps, and the very real risk that anomalous conditions go undetected.
System Crash Vulnerability (CVE-2025-36539)
Also impacting versions up to 11.00, this third flaw can be weaponized to crash the affected system entirely. Whether leveraged as a standalone disruption tactic or as part of a broader attack chain — perhaps following an authentication bypass — a forced crash introduces recovery downtime and opens windows of opportunity for further exploitation during the chaos of incident response.
Why This Matters Beyond the Patch Bulletin
Rockwell Automation's FactoryTalk platform is entrenched across critical manufacturing operations worldwide. These are not niche deployments — historian software touches everything from pharmaceutical batch records to automotive assembly line telemetry. The attack surface is vast, and the consequences of exploitation extend well beyond IT inconvenience into physical process disruption.
In OT security, the gap between "patch available" and "patch applied" is often measured in months, not days. Adversaries know this — and they plan accordingly.
The race condition vulnerability in particular should raise flags for security teams. These flaws are notoriously difficult to detect through standard testing methodologies, which means many organizations may not have identified this exposure during their last vulnerability assessment cycle. Worse, the exploitation technique — simply hammering a login endpoint — requires minimal sophistication, lowering the barrier to entry for opportunistic attackers.
The Broader ICS Security Context
These disclosures arrive against a backdrop of escalating interest in OT environments from both nation-state actors and ransomware groups. Industrial environments have historically lagged behind enterprise IT in security maturity, and historian platforms — which bridge the gap between field-level control systems and business networks — represent a particularly attractive pivot point for lateral movement.
Defenders must also reckon with the operational constraints unique to ICS patching. Maintenance windows are narrow. Downtime is costly. Vendor qualification processes are lengthy. None of these realities, however, excuse inaction when the vulnerability profile is this serious.
What You Should Do
The convergence of IT and OT networks has delivered genuine operational benefits — but it has also erased the air-gap protections that once kept industrial systems insulated from cyber threats. Every unpatched historian is a potential beachhead. The question is whether your organization closes that door before an adversary walks through it.
