Will CVE-2026-12390 (AzeoTech DAQFactory RCE) be actively exploited before end of 2026?

CISA disclosed CVE-2026-12390, a CVSS 7.6 arbitrary code execution vulnerability in AzeoTech DAQFactory ≤21.1 that allows attackers to upload malicious .ctl files. DAQFactory is used in industrial, manufacturing, and critical infrastructure environments. The CVSS severity and ICS exposure make exploitation likely if proof-of-concept code is published.

Resolution Criteria

Public disclosure by vendor, ICS-CERT, or security researcher of confirmed active exploitation (e.g., in-the-wild activity, Shodan/Censys scanning patterns, or PoC code with working exploit). Exploitation need not result in breach but must be verified by credible security advisory or threat-intelligence report.