Rockwell Automation Fixes Critical Privilege Escalation Flaw in Verve Asset Manager (CVE-2025-11862, CVSS 9.9)

Rockwell Automation has issued a patch for a critical privilege escalation flaw in Verve Asset Manager, tracked as CVE-2025-11862 with a CVSS of 9.9. The vulnerability resides in the Verve Asset Manager API and could allow read-only users to read, update, and delete other user accounts, effectively bypassing access controls. Such an issue could enable attackers with limited access to escalate privileges, disrupt security workflows, or delete administrator accounts, potentially leading to full system compromise.

The flaw affects multiple builds, specifically versions 1.33 through 1.41.3, with Rockwell releasing a fix in version 1.41.4 and later (including 1.42). Rockwell strongly urges customers to update immediately to the patched versions to prevent unauthorised access or modification via API endpoints, according to Rockwell Automation.

The update is particularly pertinent given Verve Asset Manager’s role in OT network visibility and automation tasks, where exploitation could cause major operational disruptions in energy, manufacturing, and utilities.