CVE-2025-13036
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to obtain a valid authentication token, perform a denial of service, or crash the system. The following ve...
Affects 0 products across 1 vendor.
Software behavior depends on event timing that is not enforced, allowing attackers to exploit the timing window.
Rockwell Automation FactoryTalk Historian Site Edition (SE) version 11 and earlier contains multiple vulnerabilities that allow attackers to obtain valid authentication tokens, cause denial of service, or crash the historian system. Successful exploitation could disrupt historical process data collection critical to OT operations, enable unauthorized access to industrial historian data, and potentially cascade to affect process visibility and compliance reporting. Given the CVSS vendor score of 7.7 and the role historian servers play in OT environments, this represents a high-priority patching target.
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-13036?
Is CVE-2025-13036 actively exploited?
How do I remediate CVE-2025-13036?
What systems are affected by CVE-2025-13036?
| CVE ID | CVE-2025-13036 |
|---|---|
| Published | 2026-06-18 |
| Last Modified | 2026-06-18 |
| ICS Relevance | 65% |
| Weakness (CWE) | |
| Source | NVD |
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to obtain a valid authentication token, perform a denial of service, or crash the system. The following versions of Rockwell Automation FactoryTalk Historian Site Edition are affected: FactoryTalk Historian SE 11 (CVE-2025-13036) FactoryTalk Historian SE <=11.00 (CVE-2025-44019) FactoryTalk Historian SE <=11.00 (CVE-2025-36539) CVSS Vendor Equipment Vulnerabilities v3 7.7 Rockwell Automation Rockwell Autom
Source: NIST NVD / MITRE CVE Database
| Vendor | Product | Fixed Version |
|---|---|---|
| Rockwell Automation | — | — |
No fixed version string has been publicly disclosed at time of analysis. Monitor Rockwell Automation's security advisory portal and CISA ICS-CERT advisories for patch availability. Apply patches to FactoryTalk Historian SE immediately upon release.
View Vendor Advisory →| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Block all inbound connections to FactoryTalk Historian SE server ports (default TCP 5450, 5468, and any PI/AF ports in use) from all sources except explicitly authorized engineering workstations and SCADA servers. Deploy rules on perimeter firewalls, OT DMZ firewalls, and host-based firewalls on the Historian server itself. Implement rate-limiting on authentication endpoints to detect token harvesting attempts.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.
Join free →