Home / Items
Industrial control advisorySeverity 6.8 medium
Rockwell Automation OTTO Fleet Manager
ICSA-26-239-03 · CISA · August 27, 2026
Summary
Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes.
From CISA, quoted as published. Check the source before acting.
What to do
Rockwell Automation has addressed this vulnerability in software version 2.36.3.
Users of the affected software who are not able to upgrade to the corrected version or apply the mitigations should use Rockwell Automation's security best practices.
See Rockwell Automation security advisory SD1791 for more information about this issue and instructions to enable encrypted system backup in OTTO Fleet Manager.
If you have any questions regarding the security issue(s) above and how to mitigate them, contact Rockwell Automation support.
If you have any questions regarding this disclosure, please email Rockwell Automation PSIRT: [email protected]
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-75112 | 6.8 medium | No | 0.2% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Rockwell Automation | OTTO Fleet Manager |
Why it's on these mode pages
- Maritime: Vendor table: Rockwell Automation (industrial control makers used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Rockwell Automation (industrial control makers used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Rockwell Automation (industrial control makers used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Rockwell Automation (industrial control makers used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Rockwell Automation (industrial control makers used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Rockwell Automation (industrial control makers used in every mode, all modes) (matched by rule)
Change history
- August 27, 2026: Initial Republication of Rockwell Automation SD1791.
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com