FactoryTalk Historian CVE-2026-12661

Exploitation requires two specific, concurrent prerequisites: (1) the attacker must be network-adjacent - on the same network segment, VLAN, or broadcast domain as the historian; internet-based remote exploitation is not possible given AV:A in the confirmed CVSS 4.0 vector; (2) the attacker must possess high-privilege (PR:H) authenticated credentials to the FactoryTalk® Historian Machine Edition web interface - unauthenticated exploitation is not possible. Limiting factors: the adjacency requirement excludes any attacker without a foothold on the OT network; the high-privilege credential requirement excludes low-level or guest accounts; and the impact is limited to a device crash with no data exfiltration or integrity compromise, making this a denial-of-service with no lateral escalation value inherent to the vulnerability itself.

The CVSS 4.0 score of 4.8 (Medium) accurately reflects a meaningfully constrained attack surface: AV:A limits exploitation to hosts on the same network segment or VLAN (not internet-routable), PR:H requires the attacker to already hold high-privilege authenticated credentials to the web interface, and the sole impact is VA:L - a low-severity availability disruption. No KEV listing and no disclosed POC further dampen urgency. However, in ICS/OT environments the stakes of a historian denial-of-service differ from IT contexts: loss of historian availability can interrupt regulatory compliance logging, process trend visibility, and alarm history, which may carry operational or safety implications depending on site requirements. The realistic attacker population is narrow - a malicious insider or an adversary who has already compromised an admin-level OT account and achieved adjacency, both significant prerequisites. EPSS score is not provided; given the adjacency and authentication requirements, widespread automated exploitation is implausible.

An attacker who has compromised an administrator account - via credential theft, phishing of OT personnel, or lateral movement from an already-breached engineering workstation on the same plant-floor network segment - authenticates to the FactoryTalk® Historian Machine Edition web interface and submits a series of specially crafted HTTP requests with oversized or malformed fields. The stack-based buffer overflow corrupts the historian process's stack, causing an unhandled exception and service crash. Process data recording is halted until an operator manually restarts the service or reboots the device.