Rockwell Automation Studio 5000 Logix Designer

1. Executive summary

CISA has published an advisory detailing three local vulnerabilities in Rockwell Automation Studio 5000 Logix Designer. The flaws (CVE-2026-9108, CVE-2026-9127, CVE-2026-9128) permit a local attacker to execute arbitrary code, alter configurations, or write files to arbitrary locations via malicious ACD project files or external tools configurations. None of the vulnerabilities are listed in CISA KEV and EPSS scores are at 0%, though the advisory notes high attack complexity. EMEA financial services clients with critical manufacturing or physical infrastructure dependencies utilizing Rockwell ICS environments should patch engineering workstations during the next scheduled maintenance window.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The advisory describes three distinct local vulnerabilities affecting Studio 5000 Logix Designer. All three require local access, user interaction, and possess high attack complexity.

CVE-2026-9108 (CVSS 5.4 MEDIUM, CWE-22) — Path Traversal in ACD Project Files

1. An attacker crafts a malicious ACD project file containing embedded file names with path traversal sequences (e.g., ..\..\).
2. A user opens the malicious ACD project file in Studio 5000 Logix Designer.
3. During the project opening procedure, the software fails to sanitize or validate the embedded file names.
4. The path traversal sequences escape the intended extraction directory, resulting in arbitrary files being written to attacker-controlled locations on the file system.
5. Successful file write leads to potential arbitrary code execution. Affected versions: V32.00–V32.04, V33.00–V33.03, V34.00–V34.03, V35.00, V35.01, V36.00. Fixed versions: V37.00, V36.01, V35.02, V34.04, V33.04, V32.05.

CVE-2026-9127 (CVSS 7.3 HIGH, CWE-863) — Incorrect Authorization in External Tools Configuration

1. An authenticated local user with low privileges modifies the paths of external tools configured within the application (authorization controls on the configuration file are missing).
2. The attacker alters the configuration path to point to a malicious executable.
3. When any user interacts with the external tools functionality, the malicious executable is invoked, resulting in arbitrary code execution. Affected versions: V32.00–V32.04, V33.00, V33.02, V34.00, V34.01, V35.00. Fixed versions: V36.00, V35.01, V34.02, V33.02, V32.05.

CVE-2026-9128 (CVSS 7.3 HIGH, CWE-428) — Unquoted Search Path in External Tools

1. The executable paths specified in the external tools configuration file are not properly quoted and contain spaces.
2. An attacker plants a malicious executable in a location earlier in the operating system's search order.
3. When the external tool is invoked, the OS resolves the unquoted path to the attacker's malicious executable instead of the intended application.
4. The malicious payload executes with the same permissions as the user running Studio 5000 Logix Designer. Affected versions: V32.00–V32.04, V33.00–V33.02, V34.00–V34.02, V35.00. Fixed versions: V36.00, V35.01, V34.03, V33.03, V32.05.

Discrepancy note: The CISA advisory text lists CVSS v3.1 scores of 6.7 (MEDIUM) for CVE-2026-9108 and 7.5 (HIGH) for CVE-2026-9127 and CVE-2026-9128. The authoritative verified reference data for this advisory uses the CVSS v4.0 scores: 5.4, 7.3, and 7.3 respectively. This advisory relies on the verified v4.0 scores.

4. Mitigation & containment

P1 — Within 24 hours

• Identify and isolate: Locate all engineering workstations running Studio 5000 Logix Designer. Ensure these systems are not accessible from the business network and are strictly segregated behind firewalls per CISA recommendations.
• Containment: Restrict interactive local access to these engineering workstations. Enforce least privilege to prevent low-privileged users from modifying external tool configurations (mitigates CVE-2026-9127 and CVE-2026-9128).

P2 — Within 72 hours

• Patch deployment: Upgrade Studio 5000 Logix Designer to the fixed versions corresponding to your current branch:
  • CVE-2026-9108: Upgrade to V37.00, V36.01, V35.02, V34.04, V33.04, or V32.05.
  • CVE-2026-9127: Upgrade to V36.00, V35.01, V34.02, V33.02, or V32.05.
  • CVE-2026-9128: Upgrade to V36.00, V35.01, V34.03, V33.03, or V32.05.

P3 — Within 7 days

• Compensating controls: If patching is delayed, enforce strict application whitelisting (e.g., AppLocker or WDAC) on engineering workstations to prevent unauthorized executable execution from unquoted search path locations or arbitrary file write locations.
• Process hardening: Implement Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US). Scan all inbound ACD project files for unauthorized traversal sequences before execution.

5. Indicators of compromise

No indicators of compromise available in the source material.

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

3 referenced CVEs

7. Sources

• CISA, Rockwell Automation Studio 5000 Logix Designer, https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-10, 2026-07-21
• Rockwell Automation, Security Advisories, https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html
• Rockwell Automation, Security Best Practices, https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US

8. Adverse Trace position

The vulnerabilities present a MEDIUM to HIGH risk to ICS environments but require local access, user interaction, and high attack complexity to exploit. With zero exploitation detected in the wild (EPSS 0%, not in CISA KEV), immediate emergency patching is not warranted, but upgrading during the next maintenance cycle is strongly advised. EMEA financial services clients should verify that ICS/OT networks managing physical facilities (e.g., data center infrastructure, critical manufacturing subsidiaries) are properly air-gapped from corporate IT environments. Adverse Trace will continue to monitor for any active exploitation signals.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.