CISA published ICSA-26-202-07 on 21 July 2026, documenting an authentication bypass in Rockwell Automation’s FactoryTalk Services Platform (FTSP) 6.60 that affects its Okta Web Authentication component. The vulnerability is a JWT algorithm confusion flaw — a well-understood attack class in web application security that has now appeared in industrial control system software.
Successful exploitation allows an attacker to forge a JWT token without a valid signature and impersonate an authorised user on the FTSP server. The consequence is unauthorised access to industrial system configurations managed through FactoryTalk.
CVSS score: Not published at time of writing. Rockwell rates the vulnerability as high severity.
Affected software: FactoryTalk Directory (FTSP) 6.60 only.
Patch: RAID 1158263, or the February 2026 Patch Roll-up (or later).
What Is JWT Algorithm Confusion
JSON Web Tokens (JWTs) contain three components separated by dots: header, payload, and signature. The header specifies which algorithm was used to create the signature. The server verifying the token should check the signature using the algorithm it configured — but a vulnerable implementation may trust the algorithm specified in the token’s header rather than enforcing its own configuration.
The canonical attack: the attacker creates a token with the alg field in the header set to "none". A server that accepts this value as valid will process the token and skip signature verification entirely, because “none” means no signature is required. The attacker can then set arbitrary claims in the payload — including identity and role claims — without needing to know the signing key.
In FTSP 6.60’s Okta Web Authentication implementation, the application does not verify that the JWT algorithm is configured for RSA. An attacker can submit a token with alg: "none" and the system accepts it without validating the signature. The forged token can assert an authorised identity, granting access to system configurations the attacker would not otherwise reach.
Impact in ICS Context
FactoryTalk Services Platform is a foundational component in Rockwell Automation environments. FTSP provides identity, activation, and system services for FactoryTalk applications including FactoryTalk View, FactoryTalk Historian, and FactoryTalk AssetCentre.
An attacker with network access to the FTSP server who can submit a crafted JWT can impersonate any authorised user. In an industrial environment, that means:
Unauthorised read access: Configuration data, historical data, asset records, and system topology accessible through FactoryTalk applications. For manufacturing environments, this can include process parameters, setpoints, and control logic documentation.
Potential write access: Depending on the FactoryTalk application and what the impersonated user’s account can write, configuration changes could reach PLCs, SCADA interfaces, or historian configuration. This depends on the privilege level of the impersonated identity and what downstream FactoryTalk applications are authorised to receive changes from the FTSP identity service.
Lateral movement: Authenticated sessions obtained via the forged JWT may be reused across multiple FactoryTalk applications that trust FTSP for identity. A single forged token could propagate access across multiple industrial applications in the environment.
Attack Conditions
The vulnerability requires:
- Network access to the FTSP server running FactoryTalk Services Platform 6.60.
- Knowledge of a valid username to include in the forged token’s identity claims. Username enumeration is often possible through FactoryTalk application login pages or through prior network reconnaissance.
- HTTP access to the authentication endpoint. If the FTSP Okta Web Authentication interface is accessible from the network segment the attacker is on, exploitation is straightforward.
This is not a pre-authentication remote code execution. The attacker can access system configurations but does not gain operating system command execution through this vulnerability alone. However, configuration access in an OT environment is often a precursor to more significant operational impact.
The vulnerability does not require credentials. Valid username knowledge is sufficient if the server does not enforce additional authentication factors beyond the JWT.
Remediation
Apply the patch. Rockwell Automation has released RAID 1158263 to address this vulnerability. The February 2026 Patch Roll-up and later updates also include the fix. Organisations running FTSP 6.60 should apply the update during the next available maintenance window.
To check the current version:
- Open FactoryTalk Administration Console
- Navigate to System > FactoryTalk Services Platform
- The installed version is listed in the application properties
If immediate patching is not possible:
-
Restrict network access to the FTSP server. If the authentication endpoint is reachable from untrusted network segments, isolate it at the firewall or network switch level. Only hosts that legitimately need to reach FTSP for authentication should have access.
-
Disable Okta Web Authentication if your environment is not using this specific authentication method. The vulnerability is specific to the Okta Web Authentication component. If you are using alternative authentication configurations, verify whether this component is active.
-
Review FTSP authentication logs for anomalous JWT submissions. Legitimate JWTs in a correctly functioning environment will have algorithm values of
RS256,RS384, orRS512(RSA-based algorithms). Any JWT header withalg: "none"or an algorithm unexpected for your configuration is a potential exploitation attempt.
Monitoring Guidance
Log review for potential exploitation:
FactoryTalk audit logs: Look for authentication events where the source account has access to privileged FactoryTalk applications but the login originates from an unexpected host or at an unusual time. Forged tokens will produce authentication records for legitimate usernames — monitoring for account behaviour anomalies is more effective than looking for the vulnerability directly.
Network monitoring: If you have OT network monitoring in place, alert on HTTP/HTTPS connections to the FTSP server from hosts that do not normally interact with it. Attacker reconnaissance and token submission will appear as connections from unexpected source IPs.
Application-level token logging: If FTSP’s logging verbosity can be configured to include JWT header parameters, enable it and alert on alg values other than the expected RSA algorithm.
Context: JWT Algorithm Confusion in OT Software
JWT algorithm confusion has been a documented vulnerability class in web application security since at least 2015. The attack is well-understood, well-documented, and has robust tooling for exploitation. Its appearance in FactoryTalk Services Platform 6.60 is a reminder that ICS software often incorporates web authentication components without applying the same security review rigour as web-native applications.
The specific issue — not enforcing that the alg field matches the server’s configured algorithm — is a straightforward implementation error. Most modern JWT libraries provide a mechanism to pin the expected algorithm at token verification time. The developer must explicitly use it; accepting the algorithm from the token header is the insecure default in some libraries.
For OT security teams, this is a case where patching is the only reliable fix. There is no configuration change that fully mitigates an authentication bypass in the JWT verification logic itself. Network isolation reduces the attack surface but does not close the vulnerability.