CVE-2026-12661: FactoryTalk Historian DoS Vulnerability

CVE-2026-12661 Overview

CVE-2026-12661 is a denial-of-service vulnerability in Rockwell Automation FactoryTalk Historian Machine Edition. An authenticated attacker on an adjacent network can send crafted requests to the product's web interface. These requests trigger a stack-based buffer overflow [CWE-121], causing the device to crash and become unresponsive.

The issue affects availability of an industrial data historian used to capture time-series process data from plant floor equipment. Loss of the historian can disrupt operational monitoring and troubleshooting workflows in manufacturing environments.

Critical Impact
A network-adjacent authenticated attacker can crash FactoryTalk Historian Machine Edition through crafted web interface requests, disrupting industrial data collection and monitoring.

Affected Products

Rockwell Automation FactoryTalk Historian Machine Edition
Refer to the Rockwell Automation Security Advisory SD1796 for the affected version list
Deployments exposing the Historian web interface to adjacent networks

Discovery Timeline

2026-09-01 - CVE-2026-12661 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-12661

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in the FactoryTalk Historian Machine Edition web interface. Handlers processing incoming HTTP request data copy attacker-supplied content into a fixed-size stack buffer without adequate length validation. When the input exceeds the buffer boundary, adjacent stack memory is corrupted.

The corruption produces a crash rather than reliable code execution in the reported scenario. The service terminates and the device becomes unresponsive until restarted. Historian data collection halts during the outage, creating gaps in operational telemetry.

Exploitation requires authentication and adjacent network access, limiting exposure to attackers who already hold a foothold on the same broadcast domain or logical network segment as the historian. This aligns with typical operational technology (OT) deployment patterns where the historian sits inside a plant network.

Root Cause

The root cause is insufficient bounds checking on data written to a stack buffer during web request processing. The vulnerable handler trusts request-supplied length or content sizes and performs an unsafe copy operation, allowing input to overrun the destination buffer.

Attack Vector

An attacker with valid credentials and network-adjacent access to the historian's web interface sends a specially crafted HTTP request. The request contains oversized field values engineered to overflow the target stack buffer. Processing the request corrupts stack state and crashes the service. No user interaction is required, and the attacker does not need to be on the internet-facing side of the network.

No public proof-of-concept exploit is available at the time of publication. See the Rockwell Automation Security Advisory SD1796 for vendor-provided technical details.

Detection Methods for CVE-2026-12661

Indicators of Compromise

Unexpected termination or repeated restarts of FactoryTalk Historian Machine Edition services
Gaps in historian time-series data corresponding to service crashes
Web server error entries or crash dumps generated by the Historian process
HTTP requests to the Historian web interface containing abnormally long field values or headers

Detection Strategies

Monitor Windows Application and System event logs for Historian service faults and process crashes
Alert on repeated authentication events to the Historian web interface followed by service unavailability
Inspect network traffic destined for the Historian for oversized HTTP request parameters or malformed payloads
Correlate operator reports of data collection gaps with authentication events and network activity

Monitoring Recommendations

Track availability metrics for the Historian service and generate alerts on unplanned downtime
Retain web access logs from the Historian for retrospective analysis of pre-crash requests
Baseline normal web interface traffic patterns and flag deviations in request size and frequency
Enable process crash telemetry from endpoint agents on the host running FactoryTalk Historian

How to Mitigate CVE-2026-12661

Immediate Actions Required

Apply the vendor-provided update referenced in Rockwell Automation Security Advisory SD1796
Restrict access to the Historian web interface to authorized engineering workstations only
Enforce strong, unique credentials for all Historian accounts and remove unused accounts
Review and audit recent authentication events against the Historian web interface

Patch Information

Rockwell Automation has published guidance in Security Advisory SD1796. Administrators should consult the advisory for fixed versions and update procedures specific to their deployment. Apply updates in a controlled maintenance window and validate historian data continuity after patching.

Workarounds

Segment the Historian into a dedicated OT network zone with strict firewall rules limiting inbound access
Place the web interface behind a reverse proxy or jump host that enforces authentication and request size limits
Disable the web interface on Historian instances where it is not required for operations
Apply network access control lists so that only defined engineering endpoints can reach the Historian's web port

bash

# Example Windows Firewall rule limiting Historian web interface access to a specific engineering subnet
New-NetFirewallRule -DisplayName "FactoryTalk Historian Web - Restrict" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 80,443 `
  -RemoteAddress 10.20.30.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "FactoryTalk Historian Web - Block Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 80,443 `
  -Action Block