This vulnerability (CVE-2025-13036) in FactoryTalk Historian SE version 11 involves a race condition (CWE-362) that enables authentication bypass. By continuously sending requests to the login endpoint, an attacker may exploit improper synchronization in concurrent execution to acquire a valid authentication token. The CVSS 4.0 base score is 9.2 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity with low impact on availability. No official patch or remediation guidance has been published by Rockwell Automation as of the data provided.

Successful exploitation allows an unauthenticated attacker to bypass authentication controls and obtain a valid authentication token. This can lead to unauthorized access to the FactoryTalk Historian SE system, potentially compromising sensitive operational data and system integrity. The vulnerability has a critical severity rating with a CVSS score of 9.2, indicating a high risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor Rockwell Automation advisories for updates. In the meantime, consider implementing network-level controls to restrict access to the login endpoint and apply any available compensating controls to limit exposure.