Rockwell Automation's industrial analytics platform has an authorization hole that lets network-accessible attackers issue admin commands without logging in.
CISA published an advisory for CVE-2025-14272, a missing-authorization flaw (CWE-862) affecting FactoryTalk Analytics PavilionX versions before 7.01. The bug lives in API endpoints that handle privileged operations - user creation, role assignments, and other administrative actions - but those endpoints do not actually check who is calling them. An attacker with network access and no credentials can invoke them directly. Rockwell has released version 7.01 as the fix, available through its download portal.
Missing authorization (CWE-862) consistently ranks among the most exploitable vulnerability classes precisely because there is nothing subtle about it: the check was never there, so there is nothing to bypass. For industrial control system software deployed in critical manufacturing environments worldwide, that means an attacker who reaches the network can skip straight to administrative access. The CVSS 4.0 score of 8.3 lands a full point higher than the CVSS 3.1 score of 7.0, partly because the newer scoring framework weights operational technology environments more directly.
CISA notes high attack complexity and no known active exploitation - which narrows the immediate risk, but does not change the calculus for operators running production systems on unpatched software.