Rockwell Automation disclosed a high-severity SQL injection vulnerability in its FactoryTalk DataMosaix Private Cloud platform on December 9, 2025, and released a fix. The flaw, tracked as CVE-2025-12807, lets low-privileged users wriggle past security controls and run arbitrary SQL commands through exposed API endpoints. Given the platform’s role as a bridge between factory-floor and enterprise systems, a successful attack could corrupt historian records, tamper with configuration data, or open pathways into wider industrial networks.
The vulnerability: how a simple input slip becomes a critical threat
The bug is a textbook SQL injection (CWE-89) – special characters in user-supplied input aren’t properly neutralized before they reach database queries. Rockwell’s advisory, republished by CISA on January 13, 2026, clarifies that the affected API endpoints let someone with low privileges perform sensitive database operations. That phrase is deliberately vague, but in practice it means an attacker could read, alter, or delete data without needing administrative access.
Here’s what defenders need to know at a glance:
- Affected versions: FactoryTalk DataMosaix Private Cloud 7.11, 8.00, and 8.01
- Corrected version: 8.01.02 (and later)
- Severity: CVSS v3.1 score of 8.8 (High); CVSS v4 score of approximately 8.7
- Attack vector: Network-accessible, low complexity, no user interaction required
- Exploitation status: No known public exploits when the advisory was published, but that window can close quickly
Independent vulnerability trackers, including the NVD and several regional CERTs, mirror Rockwell’s details, lending confidence to the accuracy of the affected version list and the efficacy of the fix.
Why this SQL injection hits harder than most
SQL injection is a well-worn attack pattern, but its impact in an industrial DataOps platform is uniquely dangerous. FactoryTalk DataMosaix is designed to consolidate operational technology (OT) data – from PLCs, sensors, and historians – and serve it to IT analytics tools, dashboards, and cloud connectors. Its database holds the keys to production:
- Historian and telemetry records: Tampering with these can mask equipment failures, falsify batch quality records, or create false alarms that distract operators.
- Connection and authentication tokens: Stealing or modifying these could allow attackers to pivot into engineering workstations, SCADA systems, or third-party cloud services that ingest factory data.
- Configuration metadata: Changing project templates or connector settings can silently reroute or corrupt data flows, undermining decision-making in real time.
Because the platform sits at the IT/OT boundary, a successful SQL injection attack doesn’t just steal data – it can threaten physical processes, production uptime, and regulatory compliance. In this light, that 8.8 CVSS score may actually understate the business risk.
What operators and security teams must do now
The only definitive remediation is to upgrade to version 8.01.02, which removes the vulnerable input-handling logic. Rockwell’s advisory urges users to apply the patch “if possible,” recognizing that industrial environments often cannot simply reboot a server on short notice. However, delaying the fix leaves the door open to exploitation, so a layered approach is essential:
-
Test and deploy the patch methodically
- Download the vendor-signed 8.01.02 build and run it through a staging environment that mimics your production setup.
- Confirm that all connectors, historian feeds, and backup routines still function after the update.
- Schedule a phased rollout with rollback procedures and pre/post snapshots. -
Lock down network access immediately
- Place DataMosaix instances behind strict firewalls. Allow API access only from trusted management networks and jump hosts.
- If external connectivity is unavoidable (for cloud connectors, for example), tunnel it through a VPN and require multi-factor authentication. -
Strengthen application-layer defenses
- Deploy a web application firewall (WAF) or API gateway that can detect and block SQL injection patterns targeting known DataMosaix endpoints. Tune rules to avoid false positives that might disrupt legitimate industrial traffic.
- Enforce strict input validation and schema checks at the API gateway level, rejecting unexpected parameters and overly long payloads. -
Harden identities and privileges
- Audit service accounts and application credentials. Do any have broader database roles than needed? Reduce them to the absolute minimum – read-only where possible, no direct table access beyond stored procedures.
- Rotate all service account passwords and API keys, especially those used by connectors to third-party analytics platforms. -
Increase visibility and detection
- Enable detailed logging on the database server and the application layer. Look for sudden spikes in SQL errors, unusual query patterns, or privileged commands coming from low-privilege accounts.
- If you run EDR on engineering workstations that interact with DataMosaix, watch for suspicious process launches or credential harvesting attempts shortly after unusual API calls. -
Prepare for the worst
- Have a triage playbook ready: isolate the DataMosaix instance from the network, collect logs and forensic images, invalidate all sessions, and restore from clean, immutable backups if data integrity is in doubt.
Even after patching, maintain these compensating controls. Defense-in-depth isn’t just a pre-patch stopgap; it’s the standard for industrial cyber resilience.
How we got here: the platform and the vulnerability
FactoryTalk DataMosaix is Rockwell Automation’s customer-managed industrial DataOps offering, designed for environments where on-premise data control is paramount – pharmaceutical plants, automotive assembly lines, water utilities, and other critical manufacturing sectors. It ingests raw OT data, contextualizes it, and exposes it through APIs, connectors, and visualizations. That architectural position makes it a high-value target.
The SQL injection vulnerability itself is depressingly classic: somewhere in the API code, user-supplied parameters are stitched directly into SQL queries without parameterized statements or proper escaping. When Rockwell’s internal team or an external researcher spotted the flaw, they followed coordinated disclosure, resulting in advisory SD1765 and the 8.01.02 patch. CISA’s own advisory (ICSA-26-013-02) re-emphasizes the risk and urges operators to take immediate action.
Notably, this isn’t the first time Rockwell’s data-centric products have faced security scrutiny. Other advisories have flagged cross-site scripting and multi-factor authentication bypass issues in related FactoryTalk components, reminding us that complex industrial software stacks require constant vigilance. While no specific exploitation of CVE-2025-12807 has been reported to CISA yet, the mere publication of a high-severity advisory often attracts both researchers and malicious actors.
The bigger picture: patching industrial systems is hard, but not impossible
If you run a factory, you know that patching a server isn’t like updating a smartphone. Validation cycles can take weeks, vendor interoperability must be verified, and downtime can cost millions per hour. These are legitimate barriers – but they’re also the exact barriers that threat actors count on. The gap between advisory publication and active exploitation is shrinking; with CVE-2025-12807 being trivially exploitable (low complexity, no user interaction), that gap could be measured in days rather than months.
Organizations that treat this as a top-priority engineering change – involving OT engineers, IT security, and plant management together – will be best positioned. Start the patch validation tomorrow, apply network segmentation today, and don’t assume that “no known exploits” means no risk.
Outlook: what to watch for
In the coming weeks, look for:
- Proof-of-concept code: Someone will inevitably publish a working exploit. When that happens, the risk level jumps from theoretical to immediate.
- Rockwell’s follow-up communications: If the vendor spots active exploitation or refines mitigation guidance, treat those updates as urgent.
- CISA’s KEV list: Should CISA add CVE-2025-12807 to its Known Exploited Vulnerabilities catalog, federal civilian agencies (and many private-sector followers) will have a hard deadline to patch – usually two weeks.
For now, the smart money is on a fast, methodical patching effort backed by the compensating controls outlined above. The vulnerability is real, the fix is available, and the consequences of inaction could ripple from the server room straight to the factory floor.