Executive Lead: Privilege Escalation Flaw in Industrial License Infrastructure

Industrial automation conglomerate Rockwell Automation has released security advisory SD1799 addressing a high-severity local elevation of privilege vulnerability in its ubiquitous FactoryTalk Activation Manager suite. Cataloged under universal identifier CVE-2026-16675, the security flaw carries a CVSS v4.0 base score of 8.5 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

FactoryTalk Activation Manager functions as the critical licensing and entitlement backbone for Rockwell's broader software ecosystem, including Studio 5000 Logix Designer, FactoryTalk View Site Edition (SE), and FactoryTalk AssetCentre. Deployed across engineering workstations, Human-Machine Interface (HMI) supervisory computers, and plant-wide license distribution servers, the software coordinates digital software keys across OT control networks. The vulnerability allows an authenticated local attacker with low-level operator credentials to seize unrestricted NT AUTHORITY\SYSTEM access on host operating systems, effectively bypassing role-based access control (RBAC) and Purdue Enterprise Reference Architecture (PERA) operational boundaries.

Attack Mechanics & Root Cause: Interactive Custom Action Hijacking

The root cause of CVE-2026-16675 resides in the implementation of custom installer actions executed by the Microsoft Windows Installer (MSI) engine during product installation, component repair, and routine software maintenance.

Under the Windows Installer architecture, administrative installations frequently execute deferred custom actions in an elevated system context (NT AUTHORITY\SYSTEM) to register services, configure firewall exceptions, and instantiate FlexNet Publisher license server daemons. In vulnerable builds of FactoryTalk Activation Manager (version 5.02 and earlier), several custom actions invoked command scripts and auxiliary diagnostic executables with active, unsuppressed interactive graphical properties:

  1. Unconstrained Console Creation: When a user initiates a product repair or update through the Windows Programs and Features dialog or an unattended administrative maintenance routine, the installer spawns command prompt (cmd.exe) windows without setting the CREATE_NO_WINDOW process creation flag.
  2. Interactive Desktop Attachment: Because the processes execute on the interactive desktop window station (winsta0\default), visible command shells appear momentarily or remain interactive during prolonged configuration tasks.
  3. Parent-Child Inheritance Breakdown: An authenticated local operator with physical or Remote Desktop (RDP) access can interact with the visible console window. By invoking standard Windows console shortcuts (such as navigating to file open dialogs or executing nested process breakouts), the user breaks out of the confined installer workflow directly into an administrative command prompt operating under full SYSTEM integrity.
# Architectural representation of the installer privilege escalation vector
[Low-Privilege Operator]
        │
        ▼ (Initiates Maintenance / Repair)
[Windows Installer Service (msiexec.exe)] -- (Elevated context: NT AUTHORITYSYSTEM)
        │
        ▼ (Executes Custom Action without CREATE_NO_WINDOW)
[Interactive cmd.exe / powershell.exe] -- (Visible on Desktop WinStation)
        │
        ▼ (Operator interacts via GUI Dialog / Explorer hook)
[Unrestricted SYSTEM Shell Spawned] --> Complete Host Takeover

Threat Actor Exploitation & Purdue Model Impact

Within industrial operational environments, engineering workstations and HMI supervisory nodes are frequently configured with shared, restricted local user accounts (e.g., standard floor operators or maintenance technicians). These accounts are explicitly barred from modifying system settings, installing unapproved binaries, or reconfiguring network adapter routes:

  • Level 2 / Level 3 Boundary Neutralization: An adversary who establishes initial access on an operator workstation (via a phishing payload, rogue USB, or compromised remote support tool) can immediately leverage CVE-2026-16675 to escape local sandbox constraints and establish permanent administrative persistence.
  • SCADA Asset Reconfiguration: With SYSTEM privileges, threat actors can disable local endpoint detection agents, extract stored FlexNet licensing credentials, tamper with FactoryTalk Logix Designer project files (.ACD), and inject malicious ladder logic routines directly into programmable logic controllers (PLCs).
  • Credential Harvesting: An elevated attacker can dump the Local Security Authority Subsystem Service (LSASS) process memory to obtain industrial network domain administrator hashes, facilitating rapid lateral movement across the industrial DMZ into Level 1 controller buses.

Version Comparison & Impact Matrix

Product Name Affected Versions Remediation Status CVSS v4.0 Vector
FactoryTalk Activation Manager v5.02 and all earlier builds Vulnerable — Upgrade to v5.03+ CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H (8.5)
FactoryTalk Activation Manager v5.03.00 and newer Patched — Custom actions silent Remediated
FactoryTalk View SE / Studio 5000 Bundles Bundles shipping FTAM ≤ 5.02 Update FTAM component independently Inherited vulnerability

Defensive Playbook & Actionable Remediation Checklist

Asset owners and operational technology engineers must implement the following multi-tiered mitigation strategy in alignment with IEC 62443-3-3 security requirements:

1. Deploy FactoryTalk Activation Manager Update

Download and apply the updated FactoryTalk Activation Manager release (version v5.03.00 or higher) from the official Rockwell Automation Compatibility & Downloads Center (PCDC). The updated installer suppresses all interactive console allocations during execution.

2. Audit Local Interactive Privileges via PowerShell

Ensure non-administrative operator accounts do not retain the SeInteractiveLogonRight privilege on dedicated license server hosts: 

# Query local group memberships on FactoryTalk license hosts
Get-LocalGroupMember -Group "Administrators"
Get-LocalGroupMember -Group "Users"

# Audit running FactoryTalk Activation services and security descriptors
Get-Service -Name "FactoryTalk Activation Service" | Select-Object -Property Name, Status, StartType

3. Enforce IEC 62443-3-2 Conduits & Network Segmentation

  • Isolate License Servers: Restrict network access to FactoryTalk Activation Manager ports (TCP 27000-27009 and TCP 49670) strictly to authorized engineering workstations.
  • Disable Interactive RDP Sessions: Restrict Remote Desktop Protocol access to dedicated jump hosts with multifactor authentication (MFA) and session recording enabled.
  • Monitor Windows Event Logs: Alert on rapid process creations originating from msiexec.exe spawning cmd.exe or powershell.exe with system integrity tokens (Windows Event ID 4688).