Studio 5000 CVE-2026-9127

Apply the fix described in Rockwell Automation advisory SD1783 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html); the exact patched build is not included in the provided data, so obtain the precise fixed version from that advisory rather than assuming a number - patch available per vendor advisory. As compensating controls until patched: tighten the file-system ACLs on the external-tools configuration file so only administrators can modify it (directly addresses the CWE-863 root cause, but may break workflows that legitimately edit tool paths); restrict Studio 5000 engineering workstations to single trusted users and remove low-privilege local accounts, since exploitation requires a second authenticated user (reduces attack surface at the cost of shared-workstation convenience); and avoid or disable use of the external-tools launcher feature where operationally feasible, verifying configured tool paths before invoking them (removes the trigger but disables that functionality). Enforce standard ICS host hardening and monitor for unexpected changes to the external-tools configuration.