5 minhigh
Rockwell Automation Historian ME (CVE-2025-12768, CVE-2026-12661)
Rockwell Automation FactoryTalk Historian ME contains an out-of-bounds write vulnerability (CVE-2025-12768) and a stack-based buffer overflow vulnerability (CVE-2026-12661). CVE-2025-12768 permits remote code execution with low-level authentication. CVE-2026-12661 permits denial of service with high-level authentication. Both vulnerabilities affect Series B 5.202 and Series C 7.101.
Conf:highAnalyzed:2026-09-01openrouter
Showing defanged values
- cveCVE-2025-12768An out-of-bounds write vulnerability allows an attacker with low-level authentication to achieve remote code execution on the affected device.
- cveCVE-2026-12661A stack-based buffer overflow vulnerability allows an authenticated, network-adjacent attacker to send crafted requests to the web interface, causing a denial-of-service condition.
Detection / Hunteropenrouter
What Happened
Rockwell Automation has identified two security flaws in its FactoryTalk Historian ME software, which is used in industrial control systems. The first flaw allows an attacker who has some access to the system to run malicious code on it. The second flaw allows an attacker to crash the system, making it unresponsive. Organizations using the affected versions should apply updates or follow Rockwell Automation's security best practices to reduce risk. CISA also recommends minimizing network exposure for control system devices.
Key Takeaways
- Rockwell Automation FactoryTalk Historian ME Series B 5.202 and Series C 7.101 are affected by two vulnerabilities: CVE-2025-12768 and CVE-2026-12661.
- CVE-2025-12768 is an out-of-bounds write vulnerability (CVSS 8.0) that allows an attacker with low-level authentication to achieve remote code execution.
- CVE-2026-12661 is a stack-based buffer overflow vulnerability (CVSS 4.5) that allows an authenticated, network-adjacent attacker to cause a denial-of-service condition by crashing the device.
- No known public exploitation targeting these vulnerabilities has been reported at this time.
Affected Systems
- Rockwell Automation Historian ME Series B 5.202
- Rockwell Automation Historian ME Series C 7.101
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-12768 | Rockwell Automation FactoryTalk Historian Machine Edition | High | An out-of-bounds write vulnerability allows an attacker with low-level authentication to achieve remote code execution on the affected device. |
| CVE-2026-12661 | Rockwell Automation FactoryTalk Historian Machine Edition | Medium | A stack-based buffer overflow vulnerability allows an authenticated, network-adjacent attacker to send crafted requests to the web interface, causing a denial-of-service condition. |
Attack Chain
- Initial Access: Attacker obtains low-level or high-level authentication credentials for the FactoryTalk Historian ME web interface.
- Exploitation: Attacker sends crafted requests to the web interface, triggering an out-of-bounds write (CVE-2025-12768) or stack-based buffer overflow (CVE-2026-12661).
- Impact: The attacker achieves remote code execution on the device or causes a denial-of-service condition, crashing the device.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the advisory.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The advisory describes vulnerabilities in an ICS software product. EDR coverage on ICS devices is often limited or nonexistent. |
| Network Visibility | Medium | Network monitoring for crafted requests to the web interface could detect exploitation attempts, but distinguishing malicious requests from legitimate traffic may be difficult without specific payload signatures. |
| Detection Difficulty | Hard | Detecting exploitation of these vulnerabilities requires visibility into the application layer of an ICS network, which is often opaque to standard security monitoring tools. |
Required Log Sources
- Web server logs for FactoryTalk Historian ME
- Network flow data
- ICS firewall logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for anomalous or malformed HTTP requests targeting the FactoryTalk Historian ME web interface, which may indicate exploitation attempts. | Web server access logs, network intrusion detection system alerts | Exploitation | Medium - legitimate but unusual administrative requests may trigger alerts. |
| If you have visibility into process execution on the Historian server, consider hunting for unexpected child processes or unusual process execution context following web requests, which may indicate successful remote code execution. | EDR process execution logs, Windows Event Logs | Execution | Low - unexpected processes spawned by the web server are rarely legitimate. |
Control Gaps
- Standard IT-focused EDR solutions may not provide coverage for ICS-specific applications.
- Network-based intrusion detection may lack signatures for these specific ICS vulnerabilities.
Key Behavioral Indicators
- Anomalous HTTP requests to the FactoryTalk Historian ME web interface
- Unexpected process execution originating from the Historian service account
- Sudden unresponsiveness or crashes of the Historian ME service
False Positive Assessment
Medium - detecting exploitation requires identifying anomalous requests to the web interface, which may be difficult to distinguish from legitimate administrative traffic without specific payload signatures.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider upgrading affected Rockwell Automation Historian ME installations to corrected versions if available.
- If upgrading is not immediately possible, consider implementing Rockwell Automation's security best practices as described in their support documentation.
- Evaluate whether restricting network access to the FactoryTalk Historian ME web interface to only trusted IP ranges is feasible in your environment.
Infrastructure Hardening
- Consider isolating control system networks from business networks using firewalls.
- Ensure control system devices are not accessible from the internet.
- If remote access is required, evaluate the use of VPNs and ensure they are updated to the most current version.
User Protection
- Consider implementing network segmentation to limit the blast radius of a potential compromise.
- If your EDR supports host isolation, evaluate whether this capability can be applied to ICS assets in the event of suspected compromise.
Security Awareness
- Consider incorporating ICS-specific security awareness training into existing programs, emphasizing the risks of exposed control system interfaces.
- Ensure personnel are aware of the proper reporting procedures for suspected malicious activity on control system networks.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Initial Access
Tactic
