Loading vulnerability…
SYSTEM Privilege Escalation in FactoryTalk Activation Manager Installer
CVE-2026-16675 is a local privilege-escalation vulnerability in Rockwell Automation FactoryTalk Activation Manager. Installer custom actions can create visible console windows running as SYSTEM during installation or repair operations. A low-privileged authenticated Windows user can trigger a repair operation and hijack an exposed console window to obtain a SYSTEM command prompt.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation grants the attacker NT AUTHORITY\SYSTEM privileges and full access to the affected system's files, processes, and resources. This compromises the confidentiality, integrity, and availability of the affected Windows system.
If you can’t patch tonight, do this now.
Where an upgrade cannot be deployed immediately, install the Microsoft patch addressing the MSI issue. Restrict MSI installer operations to administrators using application-control policies such as Microsoft AppLocker, and avoid system-wide third-party browser installations. Current built-in Internet Explorer and Microsoft Edge versions prevent the documented browser-based exploitation path.
Patch, then assume compromise.
Update FactoryTalk Activation Manager to version 5.03 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.