Two of the biggest names in industrial software, Siemens and Rockwell Automation, have each disclosed a critical authentication bypass in their factory-floor products, and both bugs come down to the same basic mistake: not checking how a login token was signed. The flaws were published in the same batch of advisories from the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
The same flaw, two vendors
Siemens Opcenter X, a manufacturing operations platform, carries CVE-2026-56451, rated the maximum CVSS severity of 10 out of 10. Rockwell Automation's FactoryTalk Services Platform carries CVE-2026-10714, rated 7.8. Both products use JSON Web Tokens (JWTs), a compact signed token that web applications hand a user after login to prove who they are on later requests.
How the attack works
A JWT names, in its own header, the algorithm used to sign it, and a secure application must verify that the algorithm is the one it expects. Neither product did. In Opcenter X, an unauthenticated remote attacker can forge an arbitrary JWT, bypass authentication entirely, and impersonate any user including administrators, giving full control of the application. In FactoryTalk, the platform fails to confirm the signing algorithm is RSA during Okta web authentication, letting an attacker set the algorithm to "none" and present forged tokens; a low-privilege user can then impersonate any authorized account on the server. This class of "algorithm confusion" bug has been showing up across enterprise software, including a recent SharePoint login bypass built on the same weakness.
Why it matters
These platforms sit at the heart of manufacturing and plant operations, so an identity bypass is not an abstract risk: it can hand an intruder administrative control over systems that manage physical production. The disclosures land alongside a steady stream of operational-technology flaws, including the ones we covered in CISA's earlier July advisories for Rockwell and ABB gear and a chained Siemens switch zero-day.
What you should do
Siemens has fixed Opcenter X in version V2604 and urges customers to update. Rockwell users on FactoryTalk Services Platform 6.60 should apply the individual patch (RAID 1158263) or the February 2026 patch roll-up. As always with operational technology, restrict network access to these systems and keep them off the public internet wherever possible.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.