CVE-2026-16675: CWE-307 Improper restriction of excessive authentication attempts in Rockwell Automation FactoryTalk® Activation Manager

This vulnerability involves improper restriction of excessive authentication attempts (CWE-307) in FactoryTalk® Activation Manager. The issue is due to custom installer actions that open console windows with SYSTEM privileges, which are visible and can be hijacked by an authenticated attacker. Exploiting this flaw allows escalation from a lower-privileged Windows user to SYSTEM-level access, granting full control over files, processes, and system resources. The CVSS 4.0 base score is 8.5, indicating high severity. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

An authenticated attacker with Windows credentials can escalate privileges to SYSTEM level by hijacking installer console windows. This grants full access to all system files, processes, and resources, potentially compromising the entire system integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to systems running FactoryTalk® Activation Manager to trusted users only and monitor installation or repair operations closely to detect suspicious activity.