VulnSocial

CVE-2026-16675Active Exploitation

MEDIUMCVSS 8.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows credentials could hijack these console windows to obtain a SYSTEM-level command prompt, allowing full access to all files, processes, and system resources.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-307

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-01); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-01: 1Mentions · 2026-09-03: 1Active Exploitation · 2026-09-01: 1Patch / Workaround · 2026-09-01: 1Patch / Workaround · 2026-09-03: 1Technical Details · 2026-09-01: 1Technical Details · 2026-09-03: 109-0109-03
Signal classification2 categories
Active Exploitation
150.0%
Patch
150.0%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-09-011
Active Exploitation1
2026-09-031
Patch1
Full discourse2 posts
  • Ryx@PadhiyarRushi
    Patch

    🚨 CISA just dropped ICSA-26-244-04 on Rockwell FactoryTalk Activation Manager CVE-2026-16675 – Privilege Escalation (CVSS 7.8) ⚠️ Affected: V5.02 and below The installer custom actions spawn visible console windows running as SYSTEM during install/repair. Any authenticated Windows user can hijack those windows → full SYSTEM command prompt. 💥 Full control of files, processes, and the host. ✅ Patch is out: move to V5.03 ASAP. If you’re still running older Activation Manager on engineering workstations or license servers… this is a local priv-esc waiting to happen. 👀 Anyone already seeing this in the wild or testing the install path? #OTSecurity #ICS #Rockwell #CVE202616675 #ICSSecurity #CyberSecurity

    Post summary

    The post announces the CVE-2026-16675 privilege escalation in Rockwell FactoryTalk Activation Manager, details the attack vector and CVSS score, and stresses applying the available V5.03 patch immediately.

    00010100
    576 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    Attackers are hijacking console windows during FactoryTalk Activation Manager installations to escalate from standard user to SYSTEM privileges (CVE-2026-16675). Once elevated, they gain unrestricted access to industrial control systems. Runtime segmentation can help limit blast radius in OT environments. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/rockwell-automation-factorytalk-activation-manager-cve-2026-16675-privilege-escalation-2026

    Post summary

    Attackers exploit CVE-2026-16675 by hijacking console windows during FactoryTalk Activation Manager installations to gain SYSTEM privileges; runtime segmentation is advised as a mitigation.

    0000059
    2.0K followersView on X

Explore more

Back to dashboard