Rockwell Automation OTTO Fleet Manager

CVE-2026-75112 is a weak password-hashing flaw (CWE-916) in Rockwell Automation's OTTO Fleet Manager, caused by an insufficient work factor in its bcrypt implementation that lowers the computational cost required to crack stored password hashes. The issue is triggered when an attacker obtains an unencrypted system backup that contains the weakly hashed user credentials. With that backup in hand, the attacker can conduct offline brute-force or dictionary attacks far more cheaply than expected, potentially recovering passwords and gaining access to the Fleet Manager system (confidentiality-only impact, per the CVSS 4.0 score of 6.9 with VC:H and no integrity or availability impact). Affected users are deployments of OTTO Fleet Manager whose stored password hashes use the insufficient work factor; the available data does not specify affected or fixed version ranges. No exploitation is known at this time: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.1% probability of exploitation within the next 30 days.

Do: Monitor Rockwell Automation's security advisory/knowledge base article for CVE-2026-75112 and update OTTO Fleet Manager to the patched release once the vendor publishes fixed version details. In the meantime, encrypt system backups (or restrict access to them) so stored password hashes cannot be harvested for offline cracking, and limit adjacent network and low-privileged access to Fleet Manager. If any unencrypted backup has been exposed or shared, rotate affected user credentials and ensure strong, unique passwords are in use.