The Cybersecurity and Infrastructure Security Agency has warned that Rockwell Automation FactoryTalk Activation Manager V5.02 and earlier contain a privilege-escalation vulnerability that could allow an authenticated attacker with Windows credentials to obtain a SYSTEM-level command prompt. The vulnerability, tracked as CVE-2026-16675, affects software identified by CISA as deployed worldwide in the critical manufacturing sector. Rockwell Automation recommends updating to FactoryTalk Activation Manager V5.03. Customers unable to upgrade to a corrected version should use Rockwell Automation’s security best practices. CISA lists the vulnerability with a CVSS version 3.1 base score of 7.8 and a high severity rating. The CVSS vector describes a local attack requiring low attack complexity, low privileges and no user interaction, with potential impacts to confidentiality, integrity and availability. CISA says the issue exists in custom actions used by the FactoryTalk Activation Manager installer. During installation or repair operations, those actions can spawn visible console windows running with SYSTEM privileges. An authenticated attacker with Windows credentials could hijack the console windows and obtain a SYSTEM-level command prompt, allowing full access to files, processes and system resources on the affected computer. CISA identifies the weakness under CWE-307, Improper Restriction of Excessive Authentication Attempts. The agency’s advisory credits an anonymous security researcher with reporting the vulnerability to Rockwell Automation, which reported it to CISA. CISA recommends defensive measures intended to minimize the risk of exploitation. Those measures include minimizing network exposure for control-system devices and systems and ensuring they are not accessible from the internet. The agency also recommends locating control-system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, CISA recommends more secure methods such as virtual private networks, while noting that VPNs may have vulnerabilities and should be updated to the most current version available. CISA also notes that a VPN is only as secure as the connected devices. The agency reminds organizations to perform impact analysis and risk assessment before deploying defensive measures. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of industrial control system assets. It directs organizations that observe suspected malicious activity to follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. The advisory also includes guidance on social engineering, including a recommendation not to click web links or open attachments in unsolicited email messages. CISA said no known public exploitation specifically targeting the vulnerability had been reported to the agency at the time of the advisory’s publication. The FactoryTalk Activation Manager advisory was initially released Sept. 1, 2026. (CISA advisory)