Privilege Escalation Vulnerability in FactoryTalk Activation Manager

Source context: this article examines information published by the source on September 01, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

A privilege escalation vulnerability (CVE-2026-16675) has been identified in Rockwell Automation FactoryTalk Activation Manager. The issue originates from custom actions within the software installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations.

An attacker who already possesses valid Windows credentials on the affected system could hijack these console windows to obtain a SYSTEM-level command prompt. This would grant the attacker full access to all system resources, processes, and files on the host machine.

Exposure and applicability

This vulnerability affects FactoryTalk Activation Manager versions V5.02 and below. Because this software is used for licensing and managing industrial automation assets, it is typically installed on engineering workstations or central license servers within an Operational Technology (OT) environment.

The attack vector is local; the actor must be authenticated to the Windows operating system to interact with the installer’s console windows. There is currently no report of public exploitation of this vulnerability.

Remediation priorities

Our analysis suggests that asset owners prioritize remediation based on the criticality of the host machine (e.g., a primary license server versus a standalone workstation).

• Primary Action: Update FactoryTalk Activation Manager to version V5.03, which addresses the vulnerability.
• Secondary Action: For environments where immediate updates are not feasible, we recommend implementing Rockwell Automation’s security best practices to limit the risk of unauthorized local access.
• Environmental Controls: Ensure that engineering workstations and license servers are isolated from business networks and the internet using firewalls. Access should be restricted to authorized personnel only, as this vulnerability requires existing Windows credentials to execute.

How to validate remediation

To verify that the risk has been reduced, OT security leaders and controls engineers should perform the following:

1. Version Verification: Confirm that the installed version of FactoryTalk Activation Manager is V5.03 or higher across all affected assets.
2. Access Audit: Review local user accounts on license servers and engineering workstations to ensure the principle of least privilege is applied, reducing the number of users with the credentials necessary to attempt a local hijack.

Note that while version verification confirms the patch is present, it does not guarantee total system security if other local vulnerabilities exist.

Limits and open questions

This vulnerability specifically targets the installation and repair process. It remains unclear if there are other triggers for these SYSTEM-level console windows outside of standard installer operations. Additionally, while updating to V5.03 addresses this specific flaw, it does not mitigate risks associated with compromised administrative credentials or other local privilege escalation paths within the Windows OS.

Source and editorial note

Rockwell Automation FactoryTalk Activation Manager · Source date: September 01, 2026 · Retrieved September 01, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request an OT security assessment