CISA Adds Rockwell Automation FactoryTalk DataMosaix Private Cloud Vulnerability to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a newly discovered vulnerability targeting Rockwell Automation's FactoryTalk DataMosaix Private Cloud platform to its Known Exploited Vulnerabilities catalog. This addition signals confirmed active exploitation in the wild and represents a significant threat to industrial control system (ICS) operators across manufacturing, energy, and critical infrastructure sectors.

The Vulnerability Details

The specific vulnerability tracked in CISA's database affects the FactoryTalk DataMosaix Private Cloud deployment architecture. FactoryTalk DataMosaix serves as Rockwell's industrial data management and analytics platform, designed to aggregate operational technology (OT) data from factory floor devices and provide cloud-enabled insights for manufacturing operations.

The vulnerability exists within the platform's cloud synchronization mechanisms and authentication pathways. Attackers can exploit this weakness through specially crafted network requests targeting the platform's API endpoints. The exploit chain likely involves improper input validation or authentication bypass techniques that allow unauthorized access to sensitive industrial data and control functions.

Rockwell Automation has released security patches addressing this vulnerability. The company recommends immediate application of updates through their standard software update channels. Organizations running FactoryTalk DataMosaix Private Cloud versions prior to the patched release should prioritize this update given CISA's KEV designation.

Threat Actor Analysis

While CISA has not publicly attributed this exploitation to specific threat actors, the targeting of industrial control system platforms follows established patterns observed in state-sponsored campaigns and sophisticated cybercriminal operations. ICS-focused malware and exploitation campaigns typically originate from:

• Nation-state groups seeking industrial espionage or sabotage capabilities
• Ransomware operators targeting operational technology for maximum leverage
• Initial access brokers establishing footholds in critical infrastructure

The FactoryTalk platform's role in manufacturing and process control makes it an attractive target for actors seeking to disrupt production, steal proprietary manufacturing processes, or establish persistence in OT environments.

Attack Vectors and Indicators

Exploitation likely occurs through several potential vectors:

Network-based attacks: Malicious requests sent to exposed FactoryTalk DataMosaix instances accessible from enterprise networks or, in misconfigured environments, the public internet.

Credential exploitation: Weak or default credentials in cloud synchronization components, or credential stuffing attacks against the platform's authentication mechanisms.

Supply chain compromise: Malicious updates or compromised installation packages distributed through unofficial channels.

Organizations should monitor for these indicators of compromise:

• Unusual network traffic patterns to/from FactoryTalk servers
• Unexpected authentication attempts or failed login spikes
• Anomalous data synchronization activities outside maintenance windows
• Presence of unauthorized user accounts or API keys
• Modifications to platform configuration files
• Suspicious process execution on systems hosting FactoryTalk components

Defensive Recommendations

Immediate Actions:

1. Apply Rockwell's security patches immediately to all FactoryTalk DataMosaix Private Cloud installations
2. Isolate FactoryTalk systems from direct internet access using properly configured firewalls
3. Implement network segmentation separating OT and IT environments
4. Review and rotate all API keys, service accounts, and credentials associated with the platform

Enhanced Monitoring:

• Deploy network intrusion detection systems monitoring traffic to/from FactoryTalk infrastructure
• Enable comprehensive logging on all FactoryTalk components and forward to SIEM systems
• Establish baseline normal behavior patterns for FactoryTalk operations
• Monitor Rockwell Automation security advisories for additional updates

Architectural Hardening:

• Implement zero-trust network access controls for FactoryTalk management interfaces
• Use VPNs with multi-factor authentication for remote access
• Deploy application whitelisting on systems running FactoryTalk components
• Regularly audit user permissions and access controls

Broader Implications

This vulnerability highlights the expanding attack surface in converged IT-OT environments. As industrial operations increasingly adopt cloud-enabled platforms for data analytics and operational visibility, the traditional air-gapped security model for OT systems becomes obsolete. Organizations must balance operational efficiency with security requirements, implementing defense-in-depth strategies that protect cloud-connected industrial systems.

The CISA KEV designation provides clear guidance that this vulnerability represents an active and credible threat. Organizations running Rockwell Automation FactoryTalk DataMosaix Private Cloud should treat this as a critical priority and execute patching procedures within CISA's recommended timeframe.

For detailed patching instructions and technical guidance, organizations should consult Rockwell Automation's official security advisory and the CISA Known Exploited Vulnerabilities Catalog.