EUVD-2026-69128
GHSA-8hp8-739v-6gxv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low-privilege requirement per description; scope changes to SYSTEM, warranting S:C and full C/I/A impact.
Primary rating from Vendor (Rockwell).
CVSS VectorVendor: Rockwell
Lifecycle Timeline
3DescriptionCVE.org
A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows credentials could hijack these console windows to obtain a SYSTEM-level command prompt, allowing full access to all files, processes, and system resources.
AnalysisAI
Privilege escalation in Rockwell Automation FactoryTalk® Activation Manager exposes authenticated local Windows users to full SYSTEM-level access by exploiting visible console windows spawned by the installer's custom actions during installation or repair operations. Any low-privileged user present on the machine during an install or repair sequence can interact with these unprotected, SYSTEM-privileged console windows to launch an unrestricted command shell. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker holds a valid, low-privileged interactive Windows session on the target machine - remote unauthenticated access is not viable; (2) a FactoryTalk® Activation Manager installation or repair operation must be actively running on that machine, either triggered by a co-located administrator or, if the repair can be invoked by the low-privileged user themselves, self-triggered; (3) the SYSTEM-level console window spawned by the installer's custom action must be visible and accessible to the attacker's session, which is the direct consequence of the misconfiguration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H reflects that exploitation is straightforward for any authenticated local user but is constrained to a local attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Rockwell Automation advisory SD1799 at https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1799.html for the vendor-confirmed patched version; no exact fix version number is available in the provided intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, discontinue unattended installations of FactoryTalk Activation Manager and restrict all installation and repair operations to isolated administrative environments with zero concurrent non-administrative user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today