FactoryTalk® Services Platform vulnerabilities

5 known vulnerabilities in FactoryTalk® Services Platform from Rockwell Automation. 5 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  FactoryTalk® Services Platform: Weak Authentication

  CVE-2026-10714Jul 14, 2026Rockwell Automation

  A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RS

• 8.8 High severity

  FactoryTalk® Service Platform: Incorrect Permission Assignment for Critical Resource

  CVE-2024-21915Feb 16, 2024Rockwell Automation

  A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A

• 9.1 Critical severity

  FactoryTalk® Service Platform: Improper Verification of Cryptographic Signature

  CVE-2024-21917Jan 31, 2024Rockwell Automation

  A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service to

• 8.1 High severity

  FactoryTalk® Services Platform: Improper Authentication

  CVE-2023-46290Oct 27, 2023Rockwell AutomationEPSS 5.1%

  Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® Services Platform web service and then use the token to log in into FactoryTalk® Services Platform . This vu

• 9.8 Critical severity

  Rockwell Multiple Products Insufficient Protected Credentials Exploited

  CVE-2021-22681Mar 3, 2021Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix ControllersEPSS 63.6%

  Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5