A critical vulnerability has recently been disclosed in Rockwell Automation's FactoryTalk Services Platform, identified as CVE-2026-10714, exposing a severe flaw in the JWT-based authentication mechanism. This weakness allows an attacker with local access and low privileges to bypass the token signature validation by simply changing the expected algorithm (RSA) to 'none'. As a result, the attacker can forge fake tokens and impersonate any authorized user on the FTSP server, gaining unauthorized access to system configurations and the ability to grant permissions on other systems protected by FactoryTalk.
The flaw lies in the application not verifying that the JWT algorithm is actually RSA, opening the door to the well-known 'algorithm confusion' attack. Classified under CWE-1390 (Weak Authentication), this vulnerability has been scored 7.8 (CVSS 3.1) and 8.8 (CVSS 4.0), reflecting its high impact on confidentiality, integrity, and availability of affected systems. Although not remotely exploitable, the risk is significant in industrial environments where any alteration of control configurations can have serious consequences.
Affected products include FactoryTalk Directory (FTSP) version 6.60. Rockwell Automation has released an individual patch (RAID 1158263) and a cumulative roll-up from February 2026. For those unable to update immediately, it is recommended to follow the manufacturer's security best practices, such as network segmentation, VPN usage, and continuous monitoring. Organizations operating in critical infrastructure sectors, like manufacturing, should assess their exposure and apply mitigations as soon as possible.
From a technical perspective, the attack exploits the attacker's ability to modify the JWT header to indicate a 'none' algorithm, which in vulnerable implementations makes the server accept the token without verifying any signature. This is especially dangerous if the attacker already has access to the internal network or a low-privilege terminal, potentially escalating to administrative levels undetected. The lesson is clear: strict algorithm validation and the adoption of allowed algorithm whitelists are essential measures in any system using JWT.
In this context, companies like Q2BSTUDIO, specialized in software development and technology, offer solutions that integrate security from the design phase. Our cybersecurity team performs code audits and penetration testing to identify vulnerabilities like this, helping organizations strengthen their applications before they can be exploited. We also develop custom software with robust authentication, secure session management, and compliance with standards such as OWASP.
The cloud also plays a key role in security. Through cloud AWS/Azure services, we can deploy scalable infrastructures with granular access controls, encryption, and continuous monitoring. Artificial intelligence (AI) is another powerful tool: our AI agents can detect anomalous traffic patterns and alert on suspicious authentication attempts, automating security responses. Additionally, with BI/Power BI solutions, companies can visualize access logs and security metrics in real time, facilitating decision-making.
The FactoryTalk Services vulnerability is a reminder that security is not an add-on but a fundamental component of the software lifecycle. Organizations must adopt a proactive approach, combining patches, best practices, and collaboration with secure development experts. At Q2BSTUDIO we help build robust solutions, from conception to deployment, integrating cybersecurity, cloud computing, and intelligent automation. Do not wait for an attack to happen; assess your systems today and protect your critical infrastructure with effective measures.
For more information on how we can help you secure your applications and industrial environments, do not hesitate to contact us. Your business security starts with informed decisions and the support of professionals experienced in emerging technologies.
