The operative verb in CISA's summary is reduce: successful exploitation lowers the computational cost of offline brute force against stored password hashes [1]. That reduction alone doesn't hand over access; the stated precondition is that an attacker already holds an unencrypted system backup [3], which puts CVE-2026-75112 among the bugs that price the second move of an intrusion rather than the first [16].
CISA files it as CWE-916, use of a password hash with insufficient computational effort [5], and the root cause is the work factor chosen for the bcrypt implementation [10]. Everything up to and including V2.36.2 is affected [2]. The fix is 2.36.3 [4], a patch-level increment on the same minor line [14], so the change-window argument for deferring it is thin.
The upgrade only protects credentials going forward. The advisory does not say whether installing 2.36.3 rehashes credentials already written to disk [13], and the remediation list contains no credential rotation step at all [12]. Hashes inside a backup are whatever the version that wrote them produced, so an archive taken from a 2.36.2 install still carries low-work-factor hashes after the live system is current [15]. If those backups are retained for a year, the exposure lasts a year, and its size is a function of how many copies exist and who can read them.
The other half of the remediation is configuration rather than code. Rockwell's SD1791 carries instructions for enabling encrypted system backup in OTTO Fleet Manager [6], and that control outlives this CVE, because it is what makes the next hashing mistake uninteresting.
The advisory's omissions are worth reading. Its metrics section publishes no CVSS score [11], and CISA records no known public exploitation specifically targeting the flaw [8]. Rockwell reported the issue to CISA itself [7], so the disclosure path looks like internal review rather than a response to something found in the field. Deployment is worldwide, in critical manufacturing and transportation systems [9], which is why this arrives with an ICS advisory number [17] instead of a release note.
For a site whose OTTO backups are already encrypted at rest and sit behind an access list someone can recite from memory, this is a routine upgrade and little else. For a site keeping unencrypted system backups on a general-purpose file share, the patch is the cheap part, and the work that actually closes the hole is rotating every credential the fleet manager holds and destroying the old archives.
