Source context: this article examines information published by the source on September 01, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What the vulnerability is
Two security flaws have been identified in Rockwell Automation Historian ME (FactoryTalk Historian Machine Edition), an industrial data logging system.
The first vulnerability, CVE-2025-12768, is an out-of-bounds write condition. An attacker possessing low-level authentication could exploit this flaw to achieve remote code execution (RCE) on the affected device.
The second vulnerability, CVE-2026-12661, is a stack-based buffer overflow located in the web interface. A network-adjacent attacker with authentication could send crafted requests to the interface, potentially causing the device to crash and become unresponsive (Denial of Service).
Exposure and applicability
These vulnerabilities affect the following versions of Rockwell Automation Historian ME:
* Series B: 5.202
* Series C: 7.101
Because these systems are frequently deployed in critical infrastructure—including chemical, water/wastewater, healthcare, and food and agriculture sectors—the operational impact of a system crash or unauthorized code execution could disrupt historical data logging and process visibility. Both vulnerabilities require authentication; however, the RCE flaw is accessible to users with low-level privileges.
Remediation priorities
Our analysis suggests that asset owners prioritize remediation based on the level of access granted to the Historian ME web interface and the criticality of the data being logged.
- Update Software: The primary recommendation is to upgrade to corrected versions provided by Rockwell Automation.
- Restrict Network Access: For environments where immediate upgrades are not feasible, we recommend isolating the Historian ME from business networks using firewalls and ensuring it is not accessible via the public internet.
- Secure Remote Access: If remote management is required, utilize secure methods such as Virtual Private Networks (VPNs) to limit the attack surface to authorized personnel only.
- Apply Vendor Best Practices: Implement Rockwell Automation’s security best practices for those unable to perform an immediate upgrade.
How to validate remediation
To verify that exposure has been reduced, OT security leaders and controls engineers should employ the following methods:
* Version Verification: Confirm that the installed version of Historian ME is no longer Series B 5.202 or Series C 7.101.
* Network Audit: Review firewall rules and network diagrams to ensure the web interface is not exposed to untrusted zones or the open internet.
* Access Control Review: Audit user accounts and privilege levels assigned to the Historian ME to ensure the principle of least privilege is applied, reducing the risk associated with low-level authentication flaws.
Limits and open questions
While these vulnerabilities are documented, there have been no reports of public exploitation at this time. It remains unclear exactly which “low-level” permissions are sufficient to trigger CVE-2025-12768. Additionally, because the vendor refers generally to “corrected versions,” operators must coordinate with Rockwell Automation or TechConnect to identify the specific version numbers required for their particular Series B or C deployment.
Source and editorial note
Rockwell Automation Historian ME · Source date: September 01, 2026 · Retrieved September 01, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗