CVE-2025-12768 & CVE-2026-12661: Rockwell Historian ME Remote Code Execution — Detection and Remediation Guide

CISA has published ICS advisory ICSA-26-244-06 covering two memory-corruption vulnerabilities in Rockwell Automation Historian ME — the machine-edition historian deployed at the edge of countless industrial environments. Successful exploitation can crash the device outright, and an out-of-bounds write condition may allow unauthenticated remote code execution. Both vulnerabilities carry a CVSS v3 base score of 8.0.

The affected versions are:

• Historian ME Series B 5.202 — CVE-2025-12768, CVE-2026-12661
• Historian ME Series C 7.101 — CVE-2025-12768, CVE-2026-12661

Rockwell's advisory lists deployment across Chemical, Critical Manufacturing, Food and Agriculture, Healthcare and Public Health, and Water and Wastewater Systems, worldwide. These are exactly the sectors where a historian compromise isn't an IT inconvenience — it's a path toward process visibility loss, data integrity attacks against operational records, and a beachhead into the OT network. If you run Historian ME anywhere in your environment, treat this as an urgent remediation item.

Technical Analysis

Vulnerability Overview

Both flaws are classic memory-corruption primitives in a network-reachable service:

• CVE-2025-12768 — Out-of-bounds Write (CWE-787). The Historian ME service writes data beyond the bounds of an allocated buffer when processing input it should never trust. An out-of-bounds write gives an attacker controlled memory corruption — the most reliable primitive for hijacking execution flow and achieving code execution in the context of the affected service.
• CVE-2026-12661 — Stack-based Buffer Overflow (CWE-121). A stack-resident buffer is overrun by attacker-supplied data. On a service lacking modern mitigations (which remains common in OT software), a stack overflow can overwrite return addresses or structured exception handlers, producing arbitrary code execution with no authentication required.

Attack Chain — Defender's View

1. Reconnaissance: The attacker identifies an exposed Historian ME instance. Historians are frequently reachable from both the OT network and, far too often, from enterprise IT segments or jump hosts — historians are designed to serve data upward, so they're the most commonly bridged OT asset in any architecture.
2. Exploitation: A malformed request to the listening Historian ME service triggers the out-of-bounds write or stack overflow. No credentials are required. Any host with network reachability to the service is a potential attack source.
3. Post-exploitation: Code execution in the historian service context on a Windows-based OT host. From there, expect lateral movement toward engineering workstations, OPC interfaces, and Level 2/3 systems — the historian sits at the IT/OT seam by design, which makes it an ideal pivot.
4. Impact alternative: Even without full RCE, the crash condition alone means a remote, unauthenticated attacker can take the historian offline — loss of process history, broken reporting chains, and potentially blinded operations.

Why Historians Are High-Value Targets

Historian ME collects and serves time-series process data. It is trusted by upstream consumers (MES, reporting, dashboards) and downstream producers (PLCs, controllers, OPC servers). Compromising it yields:

• Data integrity attacks: falsified historical records can mask physical process manipulation — the lesson every OT defender internalized from the Triton/Trisis era.
• Pivot position: the historian's network placement makes it the most likely single-hop bridge into the control zone.
• Operational disruption: a crashed historian breaks compliance logging and batch records in regulated industries (Food & Ag, Healthcare, Water).

Exploitation Status

At the time of this writing, CISA's advisory does not report confirmed in-the-wild exploitation, and neither CVE has been added to the CISA Known Exploited Vulnerabilities catalog. However, unauthenticated memory-corruption bugs in OT-facing services have historically moved from disclosure to weaponization quickly — and Shodan-indexable OT services are scanned continuously. Assume exploit code will emerge and act now.

Detection & Response

Memory-corruption exploitation against an OT service is noisy if you know where to look: the service crashes, the process restarts, unexpected child processes spawn, and network flows arrive from sources that have no business talking to the historian. The detections below target those observables on the Windows hosts running Historian ME and on network telemetry.

Sigma Rules

---
title: Rockwell Historian ME Service Crash or Unexpected Termination
id: 3f8a2c14-7b1d-4e59-a2c6-9d4e5f6a7b8c
status: experimental
description: Detects crash or abnormal termination of Rockwell Historian ME related service processes, a primary observable of CVE-2025-12768 / CVE-2026-12661 memory corruption exploitation (DoS condition or failed exploit attempt).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-06
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.impact
  - attack.t1499.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\\Rockwell\\'
      - '\\Historian\\'
      - 'FTAE'
      - 'RSHist'
  filter_known_restart:
    ParentImage|endswith: '\\services.exe'
  condition: selection and not 1 of filter_known_restart
falsepositives:
  - Legitimate service restarts during maintenance windows or upgrades
  - Historian service recovery triggered by Windows Service Control Manager
level: high
---
title: Historian ME Host Spawning Unexpected Child Processes
id: 8c4d5e6f-2a3b-4c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects Rockwell Historian ME service processes spawning shells, script interpreters, or LOLBins — a strong post-exploitation signal following unauthenticated RCE via CVE-2025-12768 or CVE-2026-12661.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-06
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\\Rockwell\\'
      - '\\Historian\\'
      - 'FTAE'
      - 'RSHist'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\mshta.exe'
      - '\\rundll32.exe'
      - '\\regsvr32.exe'
      - '\\certutil.exe'
      - '\\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rockwell maintenance or diagnostic tooling invoked by vendor support (verify against change records)
level: critical
---
title: Network Connection to Historian ME Host from Non-Engineering Source
id: 5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9
status: experimental
description: Detects inbound connections to Historian ME service hosts originating from outside approved engineering workstation, HMI, and MES/reporting segments. Unauthenticated exploitation of CVE-2025-12768/12661 requires only network reachability.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-06
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains: 'HIST'
    Initiated: 'false'
  filter_approved_sources:
    SourceIp|startswith:
      - '10.10.20.'
      - '10.10.30.'
  condition: selection and not 1 of filter_approved_sources
falsepositives:
  - Vulnerability scanners and monitoring platforms (whitelist known scanner IPs explicitly)
  - New reporting integrations not yet documented
level: high

Analyst note on tuning: The third rule's hostname pattern (HIST) and approved source ranges are placeholders — replace them with your actual historian host naming convention and the documented OT DMZ / engineering workstation subnets from your asset inventory. If you can't produce that list, that gap is itself a finding.

KQL — Microsoft Sentinel / Defender

This hunt surfaces crash events, suspicious child processes, and anomalous inbound flows to historian hosts. It assumes Sysmon/Defender endpoint telemetry plus Syslog/CEF ingestion from OT firewalls or network sensors monitoring the industrial DMZ.

// Hunt: Rockwell Historian ME exploitation indicators (ICSA-26-244-06)
// Part 1: Suspicious child processes spawned by Historian/Rockwell services
let HistorianProcs = dynamic(["FTAE", "RSHist", "Historian", "RnA"];
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("Rockwell", "Historian")
   or InitiatingProcessFileName has_any ("FTAE", "RSHist")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe",
                      "cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe",
                      "certutil.exe","bitsadmin.exe","whoami.exe","net.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine,
          AccountName, ReportId
| order by TimeGenerated desc;

// Part 2: Inbound network connections to historian hosts from unexpected sources
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any ("HIST", "FTME")  // tune to your historian hostnames
| where RemoteIPType == "Public"
   or (RemoteIPType == "Private" and RemoteIP !startswith "10.10.")  // tune to OT DMZ ranges
| where ActionType == "InboundConnectionAccepted"
| summarize ConnCount = count(), RemoteIPs = make_set(RemoteIP, 20),
            Ports = make_set(LocalPort, 20) by DeviceName, bin(TimeGenerated, 1h)
| order by TimeGenerated desc;

// Part 3: Syslog/CEF from OT firewalls — connections to historian services from non-approved zones
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationHostName has_any ("HIST", "FTME")
   or DeviceCustomString1 has_any ("Historian")
| where DeviceAction !in ("deny", "drop", "blocked")
| summarize FlowCount = count(), Sources = make_set(SourceIP, 25)
  by DestinationIP, DestinationPort, DeviceAction, bin(TimeGenerated, 1h)
| where FlowCount > 50   // spike threshold — baseline against normal polling volumes
| order by FlowCount desc;

Velociraptor VQL

Use this artifact to sweep suspected Historian ME hosts for post-exploitation artifacts: unexpected processes with network listeners, and recently created executables in Rockwell/Historian program paths — a common drop location when attackers achieve code execution in the service context.

-- Security Arsenal: Historian ME (ICSA-26-244-06) post-exploitation sweep
-- Processes with open network connections whose binaries live in or near
-- Rockwell/Historian paths, plus recently modified executables in those paths

LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
  FROM pslist()
  WHERE Exe =~ '(?i)rockwell|historian|ftae'

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       netstat() AS Connections
FROM procs

-- Second artifact: recently written PE files in Rockwell install paths
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Program Files*/Rockwell*/**/*.exe',
  'C:/Program Files*/Rockwell*/**/*.dll',
  'C:/Program Files*/**/*Historian*/**/*.exe'
])
WHERE Mtime > now() - 604800   -- last 7 days
ORDER BY Mtime DESC

Remediation Verification Script

Run this on candidate Windows hosts (or remotely via your RMM/EDR) to inventory Historian ME installations, confirm affected versions, and audit local firewall exposure of the historian services:

# Security Arsenal - Historian ME exposure audit (ICSA-26-244-06)
# Checks installed versions, service state, and inbound firewall exposure

$results = [ordered]@{}

# 1. Locate Rockwell Historian ME installations and versions
$installed = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
                              HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* `
  -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'Historian' -and $_.DisplayName -match 'Rockwell|FactoryTalk' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation

$results['InstalledProducts'] = $installed

# 2. Flag affected versions (Series B 5.202, Series C 7.101)
$affected = $installed | Where-Object { $_.DisplayVersion -match '5\.202|7\.101' }
if ($affected) {
  Write-Warning "AFFECTED VERSION DETECTED: $($affected.DisplayName) $($affected.DisplayVersion) - CVE-2025-12768 / CVE-2026-12661"
} else {
  Write-Host "No known-affected Historian ME versions found on $env:COMPUTERNAME" -ForegroundColor Green
}
$results['AffectedVersions'] = $affected

# 3. Check historian-related service status and crash history (last 7 days)
$services = Get-Service -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'Historian|Rockwell|FactoryTalk' }
$results['HistorianServices'] = $services | Select-Object Name, DisplayName, Status, StartType

$crashes = Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000,1001; StartTime=(Get-Date).AddDays(-7)} `
  -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Historian|FTAE|RSHist' } |
  Select-Object TimeCreated, Id, Message
if ($crashes) { Write-Warning "$($crashes.Count) application crash events for Historian processes in last 7 days - investigate for exploitation attempts" }
$results['RecentCrashes'] = $crashes

# 4. Audit inbound firewall rules exposing historian host
$inbound = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True `
  -ErrorAction SilentlyContinue |
  Where-Object { $_.Profile -match 'Any|Public' }
$results['PermissiveInboundRules'] = ($inbound | Measure-Object).Count
Write-Host "Inbound allow rules enabled: $($results['PermissiveInboundRules']) - verify historian service ports are restricted to OT DMZ/engineering sources only"

$results | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\HistorianME_Audit_$env:COMPUTERNAME.json"
Write-Host "Audit written to $env:TEMP\HistorianME_Audit_$env:COMPUTERNAME.json"

Remediation

1. Patch Immediately

• Consult Rockwell Automation's official advisory (linked from CISA ICSA-26-244-06) for the corrected Historian ME releases and upgrade paths for Series B (5.202) and Series C (7.101) installations.
• Advisory URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-06 — the CSAF machine-readable version is available from the same page for automated ingestion into your vulnerability management platform.
• Series B installations in particular should be treated as end-of-life candidates — if vendor support for the B series is limited, plan migration to a supported, patched release rather than accepting residual risk.

2. If Patching Must Wait (OT Maintenance Windows Are Real)

We know OT patching cycles are constrained by production schedules and change control. Compensating controls, in priority order:

1. Network isolation is your primary mitigation. Historian ME services should be reachable only from explicitly documented sources: the OT DMZ, designated engineering workstations, and approved MES/reporting consumers. Enforce with firewall rules or data diodes at the Level 3/Level 3.5 boundary — and audit that enforcement; historians drift open over years of "temporary" rules.
2. Block all inbound traffic to historian hosts from the internet and from general enterprise user VLANs. There is no legitimate reason a corporate workstation talks directly to a machine-edition historian.
3. Apply Windows host firewall rules on the historian host itself restricting service ports to approved source IPs — defense in depth for when the perimeter rule gets opened.
4. Increase monitoring: deploy the Sigma and KQL detections above now. Watch specifically for service crash/restart cycles (failed exploit attempts often crash the service repeatedly) and connection spikes from novel sources.

3. Verification and Validation

• Run the audit script above across your Windows OT assets to build a complete inventory — you cannot patch what you haven't found, and Historian ME is frequently installed per-machine-line and forgotten.
• After patching, validate version numbers against the advisory and re-run the audit to confirm remediation.
• Review the last 30–90 days of firewall logs for historian-bound traffic from unexpected sources. Unauthenticated exploits require no prior access — pre-patch exposure is post-patch evidence.

4. Architectural Follow-Up

This advisory is a good forcing function for a broader question: why is your historian reachable from anything you don't control? Map historian data flows against the Purdue model, document every consumer, and convert implicit trust into explicit allowlists. The historian is the most attacked seam in OT architecture precisely because it must bridge zones — make that bridge narrow, monitored, and one-directional wherever possible.

CISA Standard Guidance (Applies Here)

Per the advisory, CISA reiterates baseline OT hygiene: minimize network exposure for control system devices, ensure they are not accessible from the internet, locate control networks behind firewalls isolated from business networks, and use secure remote access methods (updated VPNs with MFA) only when remote access is required. If your historian deployment violates any of those, fix that first — before the patch, if necessary.

Bottom line: Two unauthenticated memory-corruption flaws — CVE-2025-12768 (out-of-bounds write) and CVE-2026-12661 (stack-based buffer overflow) — give remote attackers code execution or denial of service against Rockwell Historian ME, an asset that sits at the exact boundary between your enterprise and your process floor. No in-the-wild exploitation is confirmed yet, but the exposure profile demands action before that changes. Patch, isolate, and instrument for the crash-and-spawn behaviors exploitation will inevitably produce.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub