Studio 5000 CVE-2026-9127

Exploitation requires the attacker to already be an authenticated, low-privileged user on a system running Studio 5000 Logix Designer (PR:L) with write access to the application's external-tools configuration file, and it requires a second user to subsequently interact with the external-tools functionality for the malicious executable to run (UI:A / active user interaction). Limiting factors: the vector is local only (AV:L) - no remote/network exploitation; high attack complexity (AC:H) and a specific attack requirement (AT:P) mean the environment/timing must be favorable; and the payload does not execute until a victim voluntarily launches the tampered external tool, so a single-user workstation with no other interacting operators effectively blocks the privilege-crossing impact.

The vendor CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:A) paints a modest real-world risk: exploitation is local, requires an existing authenticated foothold (PR:L), carries high attack complexity plus a distinct attack requirement (AC:H/AT:P), and depends on another user actively interacting with the external-tools feature (UI:A). Offsetting that, the technical impact is severe and complete - high confidentiality, integrity, and availability on both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H) - reflecting full code execution in the victim's context, appropriate for an ICS engineering host. No EPSS score, no SSVC decision, no POC, and no KEV entry were provided, so there is no evidence of active or automatable exploitation; this reads as a genuine but not urgent issue whose priority rises sharply in shared multi-user engineering-workstation environments and falls in single-operator deployments. The signals are consistent (local vector matches config-file tampering); the main missing data points are EPSS, exploit maturity, and the exact fixed version.

A low-privileged but authenticated user on a shared Studio 5000 engineering workstation edits the poorly-protected external-tools configuration file to repoint a legitimate tool entry at a malicious executable they have planted. When a higher-privileged engineer later clicks that external tool inside Studio 5000, the attacker's payload runs in the engineer's security context, yielding arbitrary code execution on the ICS host. No public POC has been identified, and the high attack complexity plus required victim interaction make this an opportunistic rather than turnkey attack.