Critical JWT Bypass in Rockwell Automation FactoryTalk Services Platform (CVE‑2026‑10714) Risks Unauthorized Configuration Changes
What It Is — A flaw in the FactoryTalk Services Platform (FTSP) allows an attacker to bypass JWT signature validation during Okta web authentication. By setting the JWT “alg” header to none, a low‑privilege user can forge tokens and impersonate any authorized user on the FTSP server.
Exploitability — The vulnerability is publicly disclosed (CVE‑2026‑10714) with a CVSS v3 base score of 7.8 (High). No public exploit code has been released, but the attack requires only network access to the FTSP authentication endpoint and a crafted token, making exploitation feasible for motivated adversaries.
Affected Products — Rockwell Automation FactoryTalk Services Platform (FTSP) 6.60.
Why It Matters for Compliance & Audit Readiness
- SOC 2 Access Controls – The bypass directly undermines the Logical Access and Identity & Authentication criteria (CC6.1, CC6.2). Demonstrating that authentication mechanisms are hardened is essential evidence for a compliant audit.
- Continuous Monitoring – Detecting anomalous token usage and privileged‑access changes must be logged and retained as audit‑ready evidence of control effectiveness.
- Policy & Training Alignment – Organizations must ensure that token‑validation policies are documented, enforced, and that staff understand the risks of weak JWT handling.
Recommended Actions
- Apply Rockwell’s security patch for FTSP 6.60 immediately.
- Enforce strict JWT validation: reject tokens with
alg:noneand require RSA‑signed tokens. - Enable multi‑factor authentication (MFA) for all FTSP accounts and rotate any credentials that may have been exposed.
- Update access‑control policies to require periodic token‑validation testing and log all authentication events for SOC 2 evidence.
- Conduct a focused SOC 2 access‑control audit to verify that the Logical Access criteria are now met.
Source: CISA Advisory – ICSA‑26‑202‑07