Is CVE-2026-10714 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10714 being exploited in the wild.

How severe is CVE-2026-10714?

Informational severity, with a CVSS score of 8.8, published 14 July 2026.

Is there a fix for CVE-2026-10714?

A patch was published on 2026-02-01: February 2026 Patch Roll-up contains the fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10714 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-10714?

Check whether you run Rockwell Automation FactoryTalk Services Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10714: Rockwell Automation FactoryTalk Services Platform JWT validation bypass

CVE-2026-10714 · Severity: info · CVSS 8.8 · Published 2026-07-14

Rockwell Automation FactoryTalk Services Platform, which manages communication and data exchange between industrial automation components, contains a security flaw in how it handles user logins via Okta. An attacker with low-level access to the system can bypass security checks to impersonate any other user, including administrators. This could allow an unauthorized person to change critical system configurations or grant themselves access to other connected industrial systems.

Vendors: Rockwell Automation.

Quick answers

Is CVE-2026-10714 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10714 being exploited in the wild.
How severe is CVE-2026-10714?: Informational severity, with a CVSS score of 8.8, published 14 July 2026.
Which products and versions are affected?: Rockwell Automation FactoryTalk Services Platform 6.60.
Is there a fix for CVE-2026-10714?: A patch was published on 2026-02-01: February 2026 Patch Roll-up contains the fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10714 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-10714?: Check whether you run Rockwell Automation FactoryTalk Services Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A weak authentication vulnerability (CWE-1390) exists in FactoryTalk Services Platform (FTSP) v6.60 during Okta Web Authentication. The application fails to verify that the JSON Web Token (JWT) algorithm is restricted to RSA, allowing an attacker to modify the header to use the 'none' algorithm. By crafting a forged token with no signature, an authenticated user with low privileges can bypass signature validation. This enables impersonation of any authorized user on the FTSP server, providing a path to unauthorized system configuration changes and privilege escalation across protected systems. A patch (RAID 1158263) or the February 2026 Patch Roll-up is available to resolve this issue.

Affected products

Rockwell Automation FactoryTalk Services Platform (FTSP) 6.60

Timeline

2026-07-14: disclosed
2026-07-14: advisory
2026-02-01: patched: February 2026 Patch Roll-up contains the fix.

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1786.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.