CISA flags JWT forgery in Rockwell FTSP 6.60
Accepting a JSON Web Token algorithm value of `none` is the authentication failure industrial identity plumbing should never ship.
TL;DR
CISA issued ICSA-26-202-07 for CVE-2026-10714, a weak-authentication flaw in Rockwell Automation FactoryTalk Services Platform (FTSP) 6.60. A low-privilege authenticated user can set the JSON Web Token algorithm to none, forge tokens, impersonate authorized users, change configurations, and grant permissions to other FTSP-protected systems. Defense suppliers, contractors, and managed service providers running FTSP should apply RAID 1158263 or the February 2026 Patch Roll-up. CISA lists the CVSS 3.1 score as 7.8 High and reports no known public exploitation.
CISA's advisory is narrower than the worst version of this story. The CVSS 3.1 vector is local, with high attack complexity and low privileges required, and CISA says it has no reports of public exploitation. That matters for triage. It also leaves real risk for operators that already have authenticated users touching the Rockwell environment, including contractors and managed service providers maintaining critical manufacturing systems.
The design failure is the part that should bother people. In the Okta Web Authentication path, FactoryTalk Services Platform fails to verify that the JSON Web Token algorithm is configured for RSA. An authenticated low-privilege user can set the algorithm to none, craft forged tokens, and impersonate any authorized user on the FTSP server. No novel cryptanalysis is required. The server is accepting the token's instruction to stop checking the signature.
The operational answer is specific. Rockwell users on FactoryTalk Directory (FTSP) 6.60 should apply the individual patch, RAID 1158263, or the February 2026 Patch Roll-up or later update. If the corrected version cannot be deployed immediately, CISA points operators back to standard ICS containment: minimize network exposure, keep control systems off the internet, isolate control networks from business networks, and use updated VPNs for remote access.
CISA's notice also leaves a boundary question. It names FTSP 6.60 and Okta Web Authentication; it does not say whether other Rockwell authentication modules share the same JWT algorithm-validation weakness. That matters because CISA has previously carried Rockwell-reported FactoryTalk token and authentication advisories, including a 2024 service-token signing flaw and a 2023 improper-authentication token-login issue (https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-06; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-06). The patch closes this named hole. It does not answer whether the identity layer got a wider review.
Published ·Deep Fathom