CVE-2026-75112: OTTO Fleet Manager Information Disclosure

CVE-2026-75112 Overview

CVE-2026-75112 affects Rockwell Automation's OTTO® Fleet Manager. The vulnerability stems from an insufficient work factor used in the bcrypt password hashing implementation. Reduced computational cost lowers the effort required for an attacker to perform offline brute-force attacks against stored password hashes. An attacker who obtains an unencrypted system backup can more easily recover cleartext credentials from the weakly hashed data. The issue is classified under CWE-916: Use of Password Hash With Insufficient Computational Effort. Exploitation requires adjacent network access and low privileges, and the vulnerability impacts confidentiality of stored credentials.

Critical Impact
Weak bcrypt work factor enables offline brute-force recovery of stored credentials from system backups, undermining authentication across the fleet management platform.

Affected Products

Rockwell Automation OTTO® Fleet Manager
See the Rockwell Automation Security Advisory SD1791 for specific affected versions
Deployments retaining unencrypted system backups

Discovery Timeline

2026-08-19 - CVE-2026-75112 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75112

Vulnerability Analysis

OTTO® Fleet Manager stores user credentials as bcrypt hashes. Bcrypt applies a configurable cost parameter that governs how many rounds of key derivation execute during hashing. A higher cost increases computation time linearly for defenders and exponentially for attackers running offline cracking. The application configures a cost value that does not meet current guidance for password storage. Attackers with access to the hash database can therefore process candidate passwords at a rate that makes dictionary and rule-based attacks practical. This weakness does not permit direct authentication bypass. It becomes exploitable when hash material leaks through a secondary channel, most notably unencrypted system backups.

Root Cause

The root cause is a configuration choice within the bcrypt hashing routine. The selected work factor is too low relative to modern hardware capabilities, including GPU and FPGA-accelerated cracking rigs. This is a classic CWE-916 weakness: password hashes are stored using an algorithm with insufficient computational effort. The design does not compensate with additional protections such as pepper values or hardware-bound key wrapping.

Attack Vector

The attack requires access to the hash store, typically achieved by obtaining an unencrypted backup. An attacker with adjacent network access and low-privileged credentials can extract or retrieve backup artifacts containing the hash database. The attacker then performs offline cracking against the exported hashes using tools such as Hashcat or John the Ripper. Because the work factor is low, credential recovery times shrink dramatically compared to properly configured bcrypt deployments. Recovered passwords can then be reused against OTTO® Fleet Manager or other systems where users reused credentials.

No verified proof-of-concept code is available. Refer to the Rockwell Automation Security Advisory for vendor-specific technical details.

Detection Methods for CVE-2026-75112

Indicators of Compromise

Unauthorized access or copy operations against OTTO® Fleet Manager backup files or database exports.
Successful authentications from unexpected source hosts using valid credentials, particularly after backup exposure events.
Presence of unencrypted backup archives on file shares, endpoints, or removable media outside approved backup storage locations.

Detection Strategies

Audit backup storage locations for archives lacking encryption at rest and flag any deviation from the approved backup workflow.
Correlate authentication anomalies against OTTO® Fleet Manager with recent backup handling events to identify credential replay following possible hash exposure.
Monitor for enumeration of user accounts followed by successful logins that suggest brute-forced credentials from leaked hashes.

Monitoring Recommendations

Log all read, copy, and export operations on OTTO® Fleet Manager backup files and database dumps.
Alert on the creation of unencrypted backups or the disabling of backup encryption settings.
Track failed and successful authentication patterns on the fleet management platform for signs of offline-cracked credential reuse.

How to Mitigate CVE-2026-75112

Immediate Actions Required

Apply the vendor-supplied update referenced in the Rockwell Automation Security Advisory SD1791.
Encrypt all existing OTTO® Fleet Manager backups and restrict access to authorized personnel and systems.
Force a password reset for all OTTO® Fleet Manager accounts once the patch is applied to invalidate any previously exposed hashes.
Restrict adjacent network access to the fleet management platform through network segmentation and access control lists.

Patch Information

Rockwell Automation has published guidance in advisory SD1791. Administrators should consult the Rockwell Automation Security Advisory for the fixed versions, upgrade paths, and any prerequisite steps for OTTO® Fleet Manager deployments.

Workarounds

Store all backups in encrypted volumes or archives using strong keys managed outside the fleet management host.
Restrict physical and logical access to backup media and backup infrastructure to a minimal set of administrators.
Enforce strong, unique passwords and multi-factor authentication to limit the value of any credentials recovered through offline cracking.
Rotate credentials periodically and monitor for reuse of OTTO® Fleet Manager passwords across other systems.

bash

# Configuration example
# Refer to vendor advisory SD1791 for supported configuration changes.
# General guidance: ensure backup archives are encrypted at rest, for example:
tar -czf - /var/backups/otto | \
  gpg --symmetric --cipher-algo AES256 --output otto-backup.tar.gz.gpg
chmod 600 otto-backup.tar.gz.gpg