CVE-2026-16675 Overview
CVE-2026-16675 is a local privilege escalation issue in Rockwell Automation FactoryTalk® Activation Manager. The installer executes custom actions that spawn visible console windows running under the NT AUTHORITY\SYSTEM account during installation or repair operations. An authenticated local attacker with valid Windows credentials can hijack these console windows to obtain a SYSTEM-level command prompt. Successful exploitation grants full access to files, processes, and system resources on the affected host.
Critical Impact
A low-privileged local user can escalate to SYSTEM by interacting with visible installer console windows during install or repair operations, achieving full compromise of the Windows host.
Affected Products
- Rockwell Automation FactoryTalk® Activation Manager
Discovery Timeline
- 2026-09-01 - CVE-2026-16675 published to the National Vulnerability Database (NVD)
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-16675
Vulnerability Analysis
The vulnerability resides in Windows Installer custom actions used by FactoryTalk® Activation Manager. During installation or repair, these custom actions launch console (cmd.exe or console-mode helper) windows that inherit the installer's SYSTEM token. Because the console windows are rendered on the interactive desktop, a signed-in local user can interact with them directly. This produces an interactive SYSTEM shell path that bypasses the least-privilege model expected of installer helper processes.
Root Cause
The root cause is unsafe design of installer custom actions that run privileged processes with a visible user interface on the interactive desktop. Instead of executing helper binaries silently or without a window, the installer creates console windows under the SYSTEM account. Combined with Windows shell functionality that lets users spawn new processes from an existing console window, this design allows privilege inheritance from SYSTEM to a user-launched child process. The behavior is consistent with [CWE-307]-adjacent installer misuse patterns, though the primary weakness is insecure UI exposure of a SYSTEM-owned process.
Attack Vector
Exploitation requires local access and valid Windows credentials on the target host. The attacker triggers installation or repair of FactoryTalk® Activation Manager, either directly if permitted or by leveraging Windows Installer repair semantics available to authenticated users. When the SYSTEM-owned console window appears, the attacker uses standard console interactions such as file open dialogs, shortcut keys, or start commands to spawn a new process that inherits the SYSTEM token. The result is an interactive command prompt running as SYSTEM. No network access or user interaction from another account is required.
See the Rockwell Automation Security Advisory SD1799 for vendor-supplied technical details.
Detection Methods for CVE-2026-16675
Indicators of Compromise
- Unexpected cmd.exe or conhost.exe processes with a parent process of msiexec.exe running as NT AUTHORITY\SYSTEM on hosts with FactoryTalk® Activation Manager installed.
- Interactive console sessions owned by SYSTEM spawning user-context tools such as whoami.exe, net.exe, reg.exe, or powershell.exe.
- Windows Installer repair events (MsiInstaller event IDs 1035 / 1042) initiated by non-administrative users.
Detection Strategies
- Monitor process creation events (Windows Event ID 4688 or Sysmon Event ID 1) for SYSTEM-owned console processes whose parent chain traces to msiexec.exe or FactoryTalk installer binaries.
- Alert on child processes of interactive SYSTEM console windows, particularly shells or administrative tools launched shortly after installer or repair activity.
- Correlate MSI repair operations initiated by low-privileged users with subsequent privileged process launches on the same host.
Monitoring Recommendations
- Enable command-line auditing and Sysmon logging on hosts running FactoryTalk® Activation Manager to capture full process ancestry.
- Forward endpoint telemetry to a centralized analytics platform to hunt for SYSTEM-context interactive shells across the fleet.
- Baseline expected installer activity and flag repair events triggered outside of change windows or by non-administrative accounts.
How to Mitigate CVE-2026-16675
Immediate Actions Required
- Apply the fixed version of FactoryTalk® Activation Manager referenced in Rockwell Automation Security Advisory SD1799 as soon as it is available in your environment.
- Restrict interactive logon rights on engineering workstations and servers hosting FactoryTalk® Activation Manager to trusted administrators only.
- Disable or restrict Windows Installer repair for standard users via the DisableUserInstalls and AlwaysInstallElevated policy settings where operationally feasible.
Patch Information
Rockwell Automation has published remediation guidance in Security Advisory SD1799. Consult the vendor advisory for the specific fixed versions, upgrade path, and any pre-patch mitigations that apply to your deployment.
Workarounds
- Prevent non-administrative users from initiating install or repair operations of FactoryTalk® Activation Manager until the patch is applied.
- Apply Group Policy to block standard users from executing msiexec.exe with repair flags on affected hosts.
- Segment and physically secure operator workstations so that untrusted personnel cannot reach an interactive Windows session where the installer runs.
# Configuration example: block standard-user MSI repair via Group Policy registry keys
# Run in an elevated context
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v DisableMSI /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.