FactoryTalk Activation Manager CVE-2026-16675

Exploitation requires three concurrent conditions: (1) the attacker holds a valid, low-privileged interactive Windows session on the target machine - remote unauthenticated access is not viable; (2) a FactoryTalk® Activation Manager installation or repair operation must be actively running on that machine, either triggered by a co-located administrator or, if the repair can be invoked by the low-privileged user themselves, self-triggered; (3) the SYSTEM-level console window spawned by the installer's custom action must be visible and accessible to the attacker's session, which is the direct consequence of the misconfiguration. Exploitation is limited to the duration of the install/repair operation. Limiting factors: local authenticated access is mandatory; remote or unauthenticated exploitation is not possible based on the CVSS 4.0 AV:L/PR:L vector; the attack window is transient and tied to installer execution.

The vendor-assigned CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H reflects that exploitation is straightforward for any authenticated local user but is constrained to a local attack surface. No EPSS data was supplied, and this CVE is not listed in the CISA KEV catalog. No POC code has been identified. The primary real-world risk amplifier is the OT/ICS deployment context: industrial engineering workstations are frequently shared among multiple operators with varying privilege levels, and local access assumptions are often weaker in OT environments than in enterprise IT. The attack window is time-bounded to installer/repair execution, which limits opportunistic mass exploitation but does not eliminate insider or physically co-located threat scenarios. Overall, this is a genuine local privilege escalation risk rather than a remote critical - organizations with shared OT workstations running FactoryTalk software should treat this as a meaningful priority, while air-gapped or single-operator deployments face reduced but non-zero exposure.

An attacker with a low-privileged Windows domain account on a shared OT engineering workstation waits for or socially engineers an administrator to run the FactoryTalk® Activation Manager installer repair operation. When the installer's custom action spawns a visible SYSTEM-level console window, the attacker types commands directly into it - or uses it to launch a persistent SYSTEM-privileged cmd.exe - gaining unrestricted access to all files, processes, and system resources on the host. No exploit code is required; the attack leverages standard Windows interactive console behavior.