FactoryTalk Services Platform FTSP JWT Bypass Vulnerability Advisory (CVE-2026-10714)

Vulnerability Overview Vulnerability Name: FactoryTalk® Services Platform FTSP - Weak Authentication via JWT Validation Bypass CVE ID: CVE-2026-10714 Severity: High Published Date: July 14, 2026 Last Updated Date: July 14, 2026 CVSS 3.1 Base Score: 7.8/10 CVSS 4.0 Base Score: 8.8/10 CWE: CWE-1390: Weak Authentication Affected Products Affected Product: FactoryTalk - FactoryTalk® Directory (FTSP) Affected Version: 6.60 Vulnerability Description: A security issue exists in the FactoryTalk Services Platform (FTSP) that allows an attacker to bypass signature validation during Dita M Authentication. The vulnerability fails to validate JWTs configured with RSA, enabling the algorithm to be set to "none" and tokens to be forged. This may allow any authorized user to impersonate the server, leading to unauthorized configuration and access to other systems protected by FTSP. Remediation Patch Information: Customers using FactoryTalk® Services Platform v6.60 should apply a single patch (RAID 1158263) or Patch Roll-up dated February 2026 and later versions. Workarounds: Customers unable to upgrade to the corrected version should adhere to best security practices. Additional Information Known Exploited Vulnerability (KEV): No Fixed: Yes Workaround: No Summary This vulnerability involves a JWT validation bypass in the FactoryTalk® Services Platform FTSP, which may lead to unauthorized system access. Affected users are advised to apply patches or update to the corrected version as soon as possible to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

FactoryTalk Services Platform FTSP JWT Bypass Vulnerability Advisory (CVE-2026-10714)