CISA Advisory: Rockwell Automation OTTO Fleet Manager Vulnerability CVE-2026-75112

CISA released an advisory on August 27, 2026, regarding a vulnerability in Rockwell Automation OTTO Fleet Manager, identified as CVE-2026-75112. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. If an attacker gains access to an unencrypted system backup, weakly hashed credentials could be more easily compromised. The affected product is OTTO Fleet Manager versions up to and including V2.36.2. Rockwell Automation has addressed the vulnerability in software version 2.36.3. The vulnerability has a CVSS v3.1 base score of 6.8 (Medium) and CVSS v4.0 base score of 6.9 (Medium). It is not exploitable remotely and no public exploitation has been reported. CISA recommends defensive measures such as minimizing network exposure and following vendor mitigations.