Loading story…
Rockwell Automation disclosed a high-severity SQL injection vulnerability (CVE-2025-12807) affecting its FactoryTalk® DataMosaix™ Private Cloud product. The flaw, discovered during internal testing, could allow attackers to tamper with industrial data or cause denial-of-service conditions impacting safety devices, with remediation requiring manual intervention. The company has released a security advisory detailing the issue, confirming that no known exploitation has occurred and providing guidance for customers to address the vulnerability.
Security researchers highlighted the risk of data tampering and operational disruption in industrial environments due to this SQL injection flaw. The vulnerability underscores the importance of timely patching and manual remediation in critical infrastructure systems, as automated fixes are not available. Organizations using affected Rockwell products are urged to review the official advisory and implement recommended mitigations to protect against potential exploitation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A follow-up security report described the Rockwell vulnerabilities as high severity and emphasized risks including SQL injection, data tampering, and denial of service affecting safety devices. It also noted that remediation required manual action rather than an automatic fix.
Rockwell Automation published security advisory SD1765 for a SQL injection vulnerability affecting FactoryTalk DataMosaix Private Cloud. The disclosure identified the industrial product issue and made the vulnerability public.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcerockwellautomation.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity persistent cross-site scripting (XSS) vulnerability, tracked as CVE-2025-11085, was identified in the FactoryTalk DataMosaix Private Cloud platform. This flaw allows remote attackers to execute malicious JavaScript within the application, potentially leading to account takeover, credential theft, or redirection to malicious websites. The vulnerability is remotely exploitable and was disclosed by Rockwell Automation's Product Security Incident Response Team (PSIRT). Rockwell Automation published a security advisory (SD1758) confirming the existence of CVE-2025-11085, along with at least one other vulnerability (CVE-2025-11084) affecting the same product. The advisory states that the issue has been corrected, but no workaround is available. There is currently no evidence that the vulnerability has been exploited in the wild. Users of FactoryTalk DataMosaix Private Cloud are advised to apply the recommended updates to mitigate the risk associated with this vulnerability.
Jul 12, 2026
Rockwell Automation has disclosed several high-severity vulnerabilities affecting its FactoryTalk product line, including FactoryTalk View Machine Edition, PanelView Plus 7, and FactoryTalk ViewPoint. One of the vulnerabilities, tracked as CVE-2025-9064, is a path traversal issue in FactoryTalk View Machine Edition that allows unauthenticated attackers on the same network to delete arbitrary files from the device’s operating system, provided they know the filenames. This vulnerability is remotely exploitable and could lead to significant disruption or loss of critical files on affected devices. The company’s advisory SD1753 confirms that both FactoryTalk View Machine Edition and PanelView Plus 7 are impacted by this flaw, and that mitigations and workarounds are available. Another critical vulnerability, CVE-2025-9066, affects FactoryTalk ViewPoint and enables unauthenticated attackers to exploit XML External Entity (XXE) processing via certain SOAP requests. Successful exploitation of this flaw can result in a temporary denial-of-service condition, potentially disrupting industrial operations. Rockwell Automation’s advisory SD1752 details the XXE vulnerability, noting that it was discovered internally during routine security testing and that no known exploitation in the wild has been reported. Both vulnerabilities have been assigned a CVSS 4.0 base score of 8.7, indicating a high level of risk to industrial environments where these products are deployed. The advisories state that patches and workarounds are available, and customers are urged to apply them promptly to mitigate risk. The company emphasizes that the vulnerabilities are not currently known to be exploited in the wild, but the potential impact on industrial control systems is significant due to the products’ widespread use. The advisories also highlight Rockwell Automation’s commitment to transparency and proactive security practices, as these issues were identified through internal testing rather than external reports. Customers are encouraged to review the official advisories and implement recommended mitigations, including network segmentation and limiting access to trusted users. The affected products are commonly used in industrial automation environments, making timely remediation critical to prevent potential operational disruptions. The advisories provide detailed technical information and guidance for system administrators to assess and address the vulnerabilities. Rockwell Automation has made available downloadable advisories in Vulnerability Exploitability Exchange format for integration with vulnerability management tools. The company’s response includes both immediate patches and suggested workarounds for environments where patching may not be immediately feasible. Organizations using FactoryTalk View Machine Edition, PanelView Plus 7, or FactoryTalk ViewPoint should prioritize reviewing their exposure and applying the recommended security measures.
Jun 29, 2026
Rockwell Automation released patches and mitigations for more than a dozen vulnerabilities affecting industrial-control hardware and software, including **RSLinx Classic**, CompactLogix and ControlLogix controllers, ArmorStart LT, FactoryTalk products, ControlFLASH, and the Redundancy Module Configuration Tool. Five flaws are rated high severity, while four critical/high-severity RSLinx Classic denial-of-service vulnerabilities can crash the service and require a restart; other issues could enable remote or arbitrary code execution, privilege escalation, cross-site scripting, and denial-of-service attacks. The Canadian Centre for Cyber Security urged administrators to review Rockwell advisories **SD1792**, **SD1794**, **SD1797**, and **SD1798** and apply available firmware and software updates. Organizations unable to patch should reduce exposure in line with vendor guidance. A ControlLogix/CompactLogix denial-of-service advisory header identifies `CVE-2026-9637` as exploited, but the advisory body and CISA’s corresponding notice state that known exploitation has not been observed.
Sep 4, 2026