The Cybersecurity and Infrastructure Security Agency has warned that Rockwell Automation FactoryTalk Activation Manager versions 5.02 and earlier contain a high-severity privilege-escalation vulnerability that could give an authenticated Windows user a SYSTEM-level command prompt on the affected host. Rockwell Automation recommends updating the software to version 5.03. (CISA advisory)

Tracked as CVE-2026-16675, the vulnerability affects FactoryTalk Activation Manager installations identified by CISA as part of the critical manufacturing sector’s technology environment. The advisory lists the product as deployed worldwide. CISA gives the issue a CVSS version 3.1 base score of 7.8, rated high, and a CVSS version 4.0 base score of 8.5, also rated high.

The flaw is in custom actions used by the product’s installer. During installation or repair operations, those actions spawn visible console windows that run with Windows SYSTEM privileges. An authenticated attacker with Windows credentials could hijack one of those console windows and obtain a SYSTEM-level command prompt, according to the advisory. (CISA’s technical description)

SYSTEM is the highest-privilege account in Windows. The advisory states that obtaining a SYSTEM-level command prompt would allow full access to all files, processes and system resources on the affected system. The vulnerability therefore creates a path from an attacker’s existing Windows credentials to elevated control of the host, subject to the local access and authentication conditions described in the advisory.

The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It specifies local access, low attack complexity, low privileges required, no user interaction, and high ratings for the confidentiality, integrity and availability impact metrics. The CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, with a base score of 8.5 and a high severity rating.

CISA identifies the weakness as CWE-307, improper restriction of excessive authentication attempts. The affected product listing identifies FactoryTalk Activation Manager V5.02_and_below as known affected. The advisory recommends version V5.03 as the vendor fix. Customers unable to upgrade to a corrected version are directed to Rockwell Automation’s security best practices.

For organizations responsible for the product, the immediate remediation path is to inventory installations, determine whether version 5.02 or earlier is present, and update to version 5.03 where operational review permits. CISA advises organizations to perform an impact analysis and risk assessment before deploying defensive measures in control-system environments. That review is intended to account for operational requirements while addressing the affected software.

CISA also recommends minimizing network exposure for control-system devices and systems and ensuring they are not accessible from the internet. Control-system networks and remote devices should be placed behind firewalls and isolated from business networks. When remote access is required, CISA recommends more secure methods such as virtual private networks, while noting that VPN protection depends on the security of connected devices and the VPN software.

The agency encourages organizations to implement cybersecurity strategies for proactive defense of industrial control systems. It also points organizations to control-systems security guidance available through CISA’s ICS resources, including material on defense-in-depth strategies and targeted cyber intrusion detection and mitigation.

Organizations that observe suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation. CISA states that no known public exploitation specifically targeting this vulnerability has been reported at this time.