CVE-2025-9066: Rockwell Automation FactoryTalk® ViewPoint XXE to Denial-of-Service Vulnerability

Published Oct 14, 2025

Updated

A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perform XXE, resulting in a temporary denial-of-service.

Affected Software

1 affected component

Rockwell Automation FactoryTalk ViewPoint

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Panel View Plus 7 Performance Series B to a version that resolves this vulnerability.
Fixed in V14.103
Upgrade
Upgrade Panel View Plus 7 Standard and Panel View Plus 7 Performance Series A to a version that resolves this vulnerability.
Patch BF30506

Event History

Oct 14, 2025

CVE Published

via MITRE·12:15 PM

Data Sourced

via MITRE·12:15 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-9066?

CVE-2025-9066 is classified as a high-severity vulnerability due to its potential for exploitation by unauthenticated attackers.

How do I fix CVE-2025-9066?

To mitigate CVE-2025-9066, apply the latest patches provided by Rockwell Automation for FactoryTalk ViewPoint as outlined in their security advisory.

What type of attack does CVE-2025-9066 facilitate?

CVE-2025-9066 allows attackers to perform XML External Entity (XXE) attacks, which can lead to temporary denial-of-service.

Which software is affected by CVE-2025-9066?

CVE-2025-9066 specifically affects Rockwell Automation FactoryTalk ViewPoint.

Can CVE-2025-9066 be exploited without authentication?

Yes, CVE-2025-9066 can be exploited by unauthenticated attackers, making it a significant risk.