Rockwell Automation Historian ME Remote Code Execution and DoS Vulnerabilities

Source context: this article examines information published by the source on September 01, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

Two distinct security flaws have been identified in FactoryTalk Historian Machine Edition (Historian ME).

CVE-2025-12768 is an out-of-bounds write condition (CWE-787). An attacker possessing low-level authentication could exploit this flaw to achieve remote code execution (RCE) on the affected device.

CVE-2026-12661 is a stack-based buffer overflow (CWE-121) affecting the web interface. A network-adjacent attacker with authentication could send crafted requests to trigger a crash, resulting in a denial-of-service (DoS) condition where the device becomes unresponsive.

Exposure and applicability

The vulnerabilities affect the following versions of Rockwell Automation Historian ME:
* Series B: 5.202
* Series C: 7.101

Both CVEs apply to both affected series. The risk is most acute for organizations deploying these systems in critical infrastructure sectors, including chemical manufacturing, food and agriculture, healthcare, and water/wastewater systems. Because both vulnerabilities require authentication—though at different levels (low-level for RCE vs. higher requirements for DoS)—the exposure path depends on the management of local credentials and network adjacency.

Remediation priorities

Our analysis suggests prioritizing remediation based on the potential impact of the flaw:

1. Immediate Priority: CVE-2025-12768 (RCE). Due to the possibility of remote code execution, this should be addressed first. The primary corrective action is upgrading to a corrected version provided by Rockwell Automation.
2. Secondary Priority: CVE-2026-12661 (DoS). While this can cause operational downtime via device crashes, it does not allow for arbitrary code execution. This should be remediated following the RCE fix.

For environments where immediate upgrades are not feasible, we analyze the use of compensating controls to reduce exposure:
* Network Isolation: Placing Historian ME assets behind firewalls and isolating them from business networks to limit network adjacency.
* Access Control: Restricting access to the web interface and ensuring that only authorized personnel have the necessary credentials to interact with the system.
* Secure Remote Access: Utilizing updated VPNs for any required remote connectivity, rather than exposing the device directly.

How to validate remediation

To verify that exposure has been reduced, defenders should move beyond simple version checks:

• Deployment Verification: Confirm the installation of the corrected software version across all affected Series B and C instances.
• Access Validation: Audit authentication logs and permission levels to ensure “low-level” accounts do not have unnecessary access to the vulnerable components.
• Network Path Analysis: Use network mapping or firewall rule audits to verify that the web interface is not reachable from untrusted zones or the public internet.

It is important to note that implementing “security best practices” (such as network segmentation) does not remove the underlying vulnerability; it only limits the paths an attacker can take to reach it.

Limits and open questions

There are currently no reports of these vulnerabilities being exploited in the wild. However, a significant residual risk remains for any system that cannot be upgraded: the vulnerability persists in the code, meaning any compromise of authenticated credentials or a breach of the internal network could lead to exploitation.

Furthermore, while Rockwell Automation recommends security best practices as a mitigation, the specific corrected version numbers were not provided in the source. Organizations must coordinate with vendor support (TechConnect) or PSIRT to identify and acquire the exact patched releases.

Source and editorial note

Rockwell Automation Historian ME · Source date: September 01, 2026 · Retrieved September 01, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment