CISA published the advisory on September 1, while Rockwell’s accompanying SD1796 advisory supplies a key detail that the CISA summary does not: the corrected releases are Series B 5.203 and Series C 7.102. The vulnerable catalog numbers are 1756-HIST2G/B and 1756-HIST2G/C. That means this is not an open-ended warning about all FactoryTalk historian deployments, nor does it affect the separate FactoryTalk Historian Site Edition product.
The remote-code-execution issue requires an account, not internet exposure
Rockwell rates CVE-2025-12768 at 8.0 under CVSS 3.1 and 8.6 under CVSS 4.0. The flaw is an out-of-bounds write, tracked as CWE-787, and Rockwell says an attacker with low-level authentication can execute code on the affected historian module.
The access requirement materially changes the immediate response. The advisory does not describe unauthenticated exploitation, phishing, or an attack that begins from the public internet. It describes an attacker who is already authenticated and positioned on an adjacent network—typically a network segment with direct reachability to the module’s services.
That should not be read as a low-risk condition in a plant. Historian ME is intended to collect and serve time-series process data at the machine level, directly in a ControlLogix chassis. In practice, credentials used by operators, engineers, integrators, support personnel, or shared service accounts can become the entry point. A low-privilege account on an improperly segmented OT network may be enough to turn a historian appliance into a device-level code-execution target.
Rockwell’s CVSS 4.0 vector specifies low attack complexity, no user interaction, and high impact to confidentiality, integrity, and availability of the vulnerable system. The important operational takeaway is straightforward: controls that limit who can authenticate to Historian ME, and from where, are part of the mitigation—not merely administrative housekeeping.
A separate web-interface bug can take the historian offline
CVE-2026-12661 is less severe on paper, with a CVSS 3.1 score of 4.5 and a CVSS 4.0 score of 4.8. But its effect can still be disruptive in an industrial environment. According to Rockwell, an authenticated attacker on an adjacent network can send crafted requests to the Historian ME web interface, triggering a stack-based buffer overflow that causes the module to crash and become unresponsive.
Unlike the first vulnerability, the published impact for CVE-2026-12661 is denial of service rather than code execution. The distinction matters for prioritization: it is the code-execution flaw that should drive the urgency of upgrade scheduling, while the web-interface crash issue adds another reason to reduce access to the module before the upgrade can be completed.
The two CVEs affect the same versions and receive the same firmware remediation. An organization should therefore avoid treating them as two separate patching projects. One verified upgrade to Series B 5.203 or Series C 7.102 addresses both disclosed issues.
The vendor has a fix, but no product-specific workaround
Rockwell marks SD1796 as “Corrected: Yes” and “Workaround: No.” That combination is more useful than the broad language often found in industrial advisories: firmware upgrade is the intended remediation, while the fallback is generic OT hardening rather than a documented configuration change that neutralizes either flaw.
CISA recommends minimizing network exposure for control-system devices, keeping them off the internet, placing OT systems behind firewalls, separating them from business networks, and using secured remote-access methods where access is necessary. Those are sensible compensating controls, but they do not remove the vulnerabilities from a reachable 1756-HIST2G module.
For affected sites that cannot immediately install the corrected version, the short-term objective should be to make exploitation conditions harder to satisfy:
- Restrict Historian ME management and web-interface access to named administrative workstations and specifically authorized support paths.
- Review local and remote accounts with access to the affected module, remove dormant access, and eliminate shared credentials where feasible.
- Verify that business-network hosts, contractor networks, wireless segments, and remote-support connections cannot reach the historian management plane by default.
- Alert on failed and unusual authentication attempts against the module and investigate unexplained historian restarts or periods of unresponsiveness.
- Test the firmware change within the site’s normal change-control process, including the expected effect on local data collection, retrieval, and recovery procedures.
The caution around testing is practical, not a reason to defer indefinitely. CISA explicitly advises organizations to perform impact analysis and risk assessment before deploying defensive measures. For a historian embedded in a chassis, that means the patch owner should be the plant or OT team that understands the module’s data role and maintenance window—not a desktop endpoint team applying a software update blind.
Inventory needs to distinguish Historian ME from Historian SE
Rockwell’s product naming can create an avoidable triage error. FactoryTalk Historian Machine Edition is the embedded historian module identified in SD1796. FactoryTalk Historian Site Edition is a distinct on-premises platform, and it appears in other Rockwell advisories; it is not listed as affected by CVE-2025-12768 or CVE-2026-12661.
The inventory query should therefore look for the hardware and firmware combination named by Rockwell:
| Item to verify | Vulnerable state | Corrected state |
|---|---|---|
| Historian ME module | 1756-HIST2G/B or 1756-HIST2G/C | Same module family after approved firmware upgrade |
| Series B firmware | 5.202 | 5.203 |
| Series C firmware | 7.101 | 7.102 |
This also exposes the common weakness in enterprise vulnerability-management data for OT: software scanners may recognize “Rockwell Automation” or “FactoryTalk” but fail to identify an embedded catalog number, chassis location, or actual firmware level. If the historian is managed by engineering software, an asset database, or a vendor support contract rather than a conventional endpoint-management platform, that is where the version confirmation needs to happen.
No public exploitation is reported, but the window is now open
CISA says it has received no reports of public exploitation specifically targeting these vulnerabilities. Rockwell also lists neither CVE as a Known Exploited Vulnerability. As of the September 1 disclosures, there is no public indication that either issue has been added to CISA’s KEV catalog.
That absence should inform, not postpone, the response. Public disclosure provides defenders with fixed versions and identifiers to search for; it also gives attackers enough information to begin examining the affected web and authentication surfaces. The code-execution vulnerability has a low-privilege prerequisite, which makes account hygiene and segmentation meaningful immediately, but neither control substitutes for the corrected firmware.
For Windows administrators who support plant operations, the practical boundary is clear: do not treat this as a Windows cumulative-update problem, and do not assume ordinary endpoint tooling can prove remediation. Work with the ControlLogix and FactoryTalk owners to identify 1756-HIST2G Series B 5.202 and Series C 7.101 installations, restrict authenticated network access while upgrades are scheduled, and verify the move to 5.203 or 7.102 after the maintenance window closes.