Rockwell Automation FactoryTalk Services Platform

Rockwell Automation has issued a security advisory regarding a vulnerability in its FactoryTalk Services Platform (FTSP) version 6.60. An attacker could impersonate an authorized user by bypassing JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RSA, enabling an attacker to set the algorithm to "none" and craft forged tokens. This could allow an authenticated low-privilege user to impersonate any authorized user on the FTSP server, resulting in unauthorized access to system configurations and the ability to grant permissions to other systems protected by FTSP.

Affected Products Rockwell Automation FactoryTalk Services Platform Rockwell Automation Rockwell Automation FactoryTalk Directory (FTSP): 6.60

Remediation Users using FactoryTalk Services Platform v6.60 should apply either the individual patch (RAID 1158263) or the February 2026 Patch Roll-up, or later update.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. These include minimizing network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet; locating control system networks and remote devices behind firewalls and isolating them from business networks; and using more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Organizations should perform proper impact analysis and risk assessment prior to deploying defensive measures.