Which versions of FactoryTalk Historian ME are affected by CVE-2025-12768?

Rockwell Automation FactoryTalk® Historian Machine Edition contains a critical remote code execution vulnerability (CVSS 8.6) that allows adjacent-network attackers with low-privilege credentials to…

How to fix or mitigate CVE-2025-12768?

Within 24 hours: Inventory all deployed FactoryTalk Historian instances and restrict adjacent-network connectivity to only explicitly authorized systems; audit and immediately disable low-privilege user accounts with unnecessary historian access. Within 7 days: Implement network segmentation isolating historian servers to authorized management zones only; deploy network-based monitoring for suspicious traffic patterns to the historian service; review access logs for signs of compromise or lateral movement. Within 30 days: Monitor Rockwell Automation security advisories continuously for patch availability; deploy the vendor patch immediately upon release to all affected instances; conduct a full access control review to enforce principle of least privilege across all historian users.

FactoryTalk Historian ME CVE-2025-12768

Q: What is the CVSS score of CVE-2025-12768?

CVE-2025-12768 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210818 HIGH

Out-of-bounds Write (CWE-787)

2026-09-01 Rockwell

GHSA-f7wq-9ch9-3gvp

RCE Buffer Overflow Memory Corruption Factorytalk Historian Machine Edition Rockwell Automation

8.6

CVSS 4.0 · Vendor: Rockwell

Severity by source

Vendor (Rockwell) PRIMARY

8.6 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Adjacent network vector and low-privilege requirement match the vendor-supplied CVSS 4.0 vector; unchanged scope reflects SC:N/SI:N/SA:N in the 4.0 data.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 01, 2026 - 14:38 vuln.today

CVE Published

Sep 01, 2026 - 13:40 cve.org

HIGH 8.6

DescriptionCVE.org

A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device.

AnalysisAI

Remote code execution in Rockwell Automation FactoryTalk® Historian Machine Edition allows an adjacent-network attacker holding low-privilege credentials to fully compromise the historian host via a memory corruption flaw. The root cause is CWE-787 (Out-of-bounds Write), consistent with a buffer overflow in the historian's network-facing service, yielding full confidentiality, integrity, and availability impact on the affected device. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at the time of analysis.

Technical ContextAI

FactoryTalk® Historian Machine Edition is Rockwell Automation's OT/ICS time-series data historian, used to collect and archive process data from industrial control systems such as PLCs and SCADA devices. The affected CPE - cpe:2.3:a:rockwell_automation:factorytalk®_historian_machine_edition:*:*:*:*:*:*:*:* - lists all versions as affected with no version floor published. CWE-787 (Out-of-bounds Write) identifies the root cause as a memory safety failure, most commonly manifesting as a classic stack or heap buffer overflow in network input parsing routines. In OT historian software, such services frequently run with elevated system privileges and are persistently reachable from engineering workstations on the OT segment, making memory corruption particularly high-impact in this deployment context.

RemediationAI

Consult Rockwell Automation Security Advisory SD1796 at https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1796.html for the vendor-released patch and exact fixed version - no specific patched version number was independently confirmable from the available input data, so the advisory is the authoritative source for upgrade instructions. As an interim compensating control, enforce strict OT network segmentation to ensure only authorized engineering workstations can reach the FactoryTalk Historian service port; this addresses the AV:A exposure but does not protect against insider threats or post-breach lateral movement. Additionally, audit and minimize the number of accounts holding any level of credential access to the historian service, reducing the pool of credentials that could satisfy the PR:L requirement. Monitor for unexpected process crashes or memory-fault events on historian hosts, which may indicate unsuccessful exploit attempts.