A critical authentication vulnerability in Rockwell Automation's FactoryTalk Services Platform version 6.60 exposes a fundamental weakness in how industrial control systems validate user identity. The flaw allows attackers to bypass JSON Web Token (JWT) signature validation during Okta Web Authentication by manipulating the JWT algorithm field to "none," enabling them to craft forged tokens and impersonate any authorized user on the FactoryTalk Services Platform server.
This isn't a remote exploit scenario. The vulnerability requires local access and low-privilege credentials. But once inside your network perimeter, an attacker gains the ability to impersonate administrators, modify system configurations, and grant permissions to other systems protected by FactoryTalk Services Platform.
Vulnerability Details
The CISA published advisory details on this vulnerability (CVE-2026-10714) with a CVSS v3.1 score of 7.8 (High) and CVSS v4.0 score of 8.8 (High). The technical root cause: FactoryTalk Services Platform fails to verify that the JWT algorithm is configured for RSA cryptographic signing. When the application accepts a JWT with the algorithm field set to "none," it processes the token without signature validation.
The affected system, FactoryTalk Directory (FTSP) 6.60, serves as the authentication backbone for Rockwell Automation's industrial automation ecosystem. Organizations in critical manufacturing sectors worldwide rely on this platform to control access to operational technology environments.
Key Findings
JWT algorithm validation is missing entirely. The application doesn't enforce that tokens use RSA-based signing. This violates the core security assumption of JWT-based authentication: that the signature proves the token's authenticity. Without algorithm enforcement, an attacker with network access can present unsigned tokens that the system accepts as valid.
Privilege escalation follows authentication bypass. Once an attacker forges a token for an administrative account, they inherit full configuration authority. This includes the ability to grant permissions to other systems within the FactoryTalk ecosystem, expanding the attack surface beyond the initial entry point.
Local access reduces but doesn't eliminate risk. The CVSS vector string (AV:L/AC:H/PR:L) indicates local access with high attack complexity and low privileges required. Your network segmentation becomes the primary control. If an attacker gains a foothold through phishing, supply chain compromise, or insider threat, this vulnerability becomes exploitable.
No remote exploitation reported yet. CISA states no known public exploitation specifically targeting this vulnerability has been reported. The "not exploitable remotely" designation provides a narrow window for remediation before attack tooling evolves.
The vulnerability stems from weak authentication, not implementation bugs. CWE-1390 (Weak Authentication) classification indicates this is a design-level issue in how the platform validates identity, not a coding error you can patch with input sanitization. The authentication mechanism itself requires architectural review.
Implications for Your Team
If you run FactoryTalk Services Platform 6.60 in your operational technology environment, you're managing a privilege escalation path that bypasses your identity controls. The practical impact depends on your network architecture.
Consider your current state: How many systems authenticate through FactoryTalk Directory? What configuration changes could an impersonated administrator make? In industrial control systems, configuration changes can affect physical processes, safety systems, and production continuity.
Your authentication trust model assumes JWT signatures prove token authenticity. This vulnerability breaks that assumption for FactoryTalk Services Platform. Until you patch or implement compensating controls, you're relying entirely on network segmentation to prevent exploitation.
The attack complexity rating (AC:H) suggests exploitation isn't trivial, but it's achievable for an attacker who has studied the JWT handling code or obtained documentation about the flaw. Once exploitation techniques are documented publicly, complexity drops significantly.
Action Items by Priority
Immediate (this week):
Inventory all FactoryTalk Services Platform 6.60 deployments. Document which systems authenticate through FactoryTalk Directory and what permissions those systems have. This mapping tells you the blast radius if the vulnerability is exploited.
Verify network isolation for control system devices. CISA recommends ensuring control systems are not accessible from the internet and are located behind firewalls isolated from business networks. Audit your firewall rules, jump host configurations, and VPN access policies. If you allow direct business network access to FactoryTalk Services Platform, you've expanded the attack surface beyond local access.
Review authentication logs for anomalies. Look for authentication events from unexpected source IPs, unusual time-of-day access patterns, or privilege escalations that don't match your change management records. While you can't detect JWT algorithm manipulation directly without deep packet inspection, you can spot the downstream effects of successful impersonation.
Short-term (next 30 days):
Contact Rockwell Automation for patch availability and deployment guidance. Rockwell reported this vulnerability to CISA, indicating they're aware and likely developing remediation. Establish a direct communication channel with your Rockwell account team for patch notifications.
Implement Just-in-Time Access for administrative accounts in FactoryTalk environments. If administrators only receive elevated privileges when needed and for limited time windows, you reduce the window during which an attacker can use forged tokens. This doesn't fix the vulnerability but limits exposure.
Strengthen VPN security if you use remote access for control systems. CISA notes that VPNs should be updated to the most current version and that VPN security depends on the security of connected devices. Audit your VPN configurations for multi-factor authentication, device posture checks, and session timeout policies.
Medium-term (next 90 days):
Conduct a broader review of JWT implementation across your industrial control systems. This FactoryTalk vulnerability reveals a pattern: authentication mechanisms in operational technology environments may not receive the same security scrutiny as enterprise IT systems. Audit other ICS platforms for similar algorithm validation weaknesses.
Implement defense-in-depth strategies following CISA's guidance. CISA publishes technical papers on targeted cyber intrusion detection and mitigation strategies for ICS environments. Layer your controls: network segmentation, application-level authentication, monitoring, and incident response procedures specific to operational technology.
Update your incident response procedures for ICS authentication compromises. Your Computer Security Incident Response Team should have specific playbooks for scenarios where an attacker gains administrative access to industrial control systems. Define containment steps that don't disrupt production while preventing lateral movement.
CISA Recommended Practices for Industrial Control Systems Security
