CVE-2026-10714 Overview
CVE-2026-10714 is a JWT signature validation bypass in Rockwell Automation FactoryTalk® Services Platform (FTSP). The flaw exists in the Okta Web Authentication flow. FTSP does not verify that the JWT alg header is set to RSA. An attacker can set the algorithm to none and craft forged tokens accepted by the server. An authenticated low-privilege user can impersonate any authorized user on the FTSP server. Successful exploitation grants unauthorized access to system configuration and the ability to grant permissions to other systems protected by FTSP. This weakness is categorized under CWE-1390: Weak Authentication.
Critical Impact
An authenticated low-privilege user can impersonate arbitrary authorized users on the FTSP server, gaining control over system configuration and downstream permission grants.
Affected Products
- Rockwell Automation FactoryTalk® Services Platform (FTSP)
- FTSP deployments configured for Okta Web Authentication
- Downstream industrial control systems protected by FTSP
Discovery Timeline
- 2026-07-14 - CVE-2026-10714 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-10714
Vulnerability Analysis
The vulnerability is a JSON Web Token (JWT) signature validation bypass. FTSP integrates with Okta for Web Authentication and consumes JWTs issued during the login flow. The token validation logic accepts the alg value present in the JWT header without enforcing that it match the expected RSA algorithm. When the header specifies alg: none, the server treats the token as unsigned and skips signature verification. An attacker constructs a token with arbitrary claims, including a target sub or user identifier, and submits it to authenticate as that user. The result is a full identity impersonation primitive against any principal authorized in FTSP.
Root Cause
The root cause is missing algorithm confusion protection in the JWT verification routine. Secure JWT libraries require the verifier to pin the accepted algorithm to the key type. FTSP instead trusts the algorithm declared in the token header. This aligns with [CWE-1390: Weak Authentication], where the authentication mechanism fails to enforce cryptographic integrity of the credential material.
Attack Vector
Exploitation requires local access and existing low-privilege authenticated access to the FTSP environment. The attacker generates a JWT with the header {"alg":"none","typ":"JWT"} and a payload containing the identity claims of a target high-privilege user. Because the signature segment is empty and the server does not enforce RSA verification, the forged token passes validation. The attacker then acts within FTSP under the elevated identity, modifying configuration and issuing permissions to other systems protected by FTSP. Refer to the Rockwell Automation Security Advisory SD1786 for vendor-specific technical detail.
Detection Methods for CVE-2026-10714
Indicators of Compromise
- JWTs presented to FTSP with header alg set to none or any non-RSA value
- Authentication events where a low-privilege account is followed by session activity attributed to a privileged user
- FTSP configuration changes or permission grants originating from unexpected source accounts or hosts
- Okta authentication logs lacking a corresponding upstream sign-in event for the impersonated user
Detection Strategies
- Inspect FTSP authentication logs for JWT header anomalies and correlate token iat/exp values against Okta issuance records
- Alert on discrepancies between the Okta identity provider audit trail and FTSP session establishment events
- Baseline privileged administrative actions in FTSP and flag actions performed by accounts that recently authenticated from a low-privilege context
Monitoring Recommendations
- Forward FTSP and Okta authentication telemetry to a centralized SIEM for cross-source correlation
- Monitor for permission-grant and configuration-modification events on FTSP and downstream protected systems
- Track process and network activity on FTSP servers for unexpected local access from operator or engineering workstations
How to Mitigate CVE-2026-10714
Immediate Actions Required
- Apply the fixed FTSP release identified in Rockwell Automation Security Advisory SD1786
- Restrict local and interactive access to FTSP servers to authorized administrators only
- Rotate any credentials or session artifacts that may have been exposed to low-privilege users
- Audit FTSP configuration and downstream permission grants for unauthorized changes
Patch Information
Rockwell Automation has published advisory SD1786 addressing CVE-2026-10714. Consult the vendor advisory for the exact fixed version, applicability to each FTSP deployment, and upgrade procedures. Apply the patch on all FTSP servers using Okta Web Authentication before restoring normal access.
Workarounds
- Disable Okta Web Authentication on FTSP until the patch is applied, where operationally feasible
- Enforce network segmentation so that only trusted administrative hosts can reach the FTSP authentication endpoints
- Require multi-factor authentication and least-privilege role assignments for all FTSP accounts to reduce the pool of accounts that can initiate an exploitation attempt
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
