Which versions of Studio 5000 are affected by CVE-2026-9128?

Rockwell Automation Studio 5000 Logix Designer contains a local privilege escalation vulnerability (CVE-2026-9128) that allows low-privileged development environment users to gain operator-level…

How to fix or mitigate CVE-2026-9128?

Within 24 hours, identify all systems running Studio 5000 Logix Designer and audit which users have local access; implement principle-of-least-privilege on affected machines. Within 7 days, restrict local user privileges to prevent writing to system path directories, disable External Tools functionality if unused, and configure file monitoring on installation directories. No vendor-released patch identified at time of analysis; within 30 days, contact Rockwell Automation regarding patch availability and evaluate whether development environments can be air-gapped from production control systems.

Studio 5000 CVE-2026-9128

Q: What is the CVSS score of CVE-2026-9128?

CVE-2026-9128 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-43711 HIGH

Unquoted Search Path or Element (CWE-428)

2026-07-14 Rockwell

GHSA-9425-qrrg-4g6q

RCE Studio 5000 Logix Designer Rockwell Automation

7.3

CVSS 4.0 · Vendor: Rockwell

Severity by source

Vendor (Rockwell) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.7 MEDIUM

Local access with low privileges (AV:L/PR:L), requires a writable earlier path plus operator action (AC:H/UI:R); code runs in the user's own context so scope unchanged (S:U) with full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 16:03 vuln.today

CVE Published

Jul 14, 2026 - 15:12 cve.org

HIGH 7.3

DescriptionCVE.org

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.

AnalysisAI

Local arbitrary code execution in Rockwell Automation Studio 5000 Logix Designer arises because the External Tools configuration stores executable paths that contain spaces without quoting (CWE-428). A low-privileged local user who can write a malicious binary into an earlier segment of the resolved search path can have Windows execute it in place of the intended tool, running code with the privileges of the operator using the application. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 score is 7.3 (High), tempered by local access, high attack complexity, a present attack requirement, and required active user interaction.

Technical ContextAI

The issue is a classic unquoted search path (CWE-428) affecting Windows process creation. When Studio 5000 Logix Designer launches an external tool whose configured path is unquoted and contains spaces (e.g. C:\Program Files\Some Tool\tool.exe), the Windows CreateProcess resolution logic tokenizes the string on spaces and probes candidate executables in order (C:\Program.exe, C:\Program Files\Some.exe, etc.) before reaching the intended binary. If any of those earlier, attacker-writable locations contains a planted executable, the OS runs it instead. The affected component is the External Tools configuration feature of the Logix Designer engineering workstation software (cpe:2.3:a:rockwell_automation:studio_5000_logix_designer), Rockwell's flagship IEC 61131-3 programming environment for ControlLogix/CompactLogix PLCs.

RemediationAI

Apply the update identified in Rockwell Automation security advisory SD1783 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html); an exact fixed version is not included in the provided data, so obtain it directly from that advisory rather than assuming a version number. As compensating controls until patched: restrict who can log in to and run software on the engineering workstation (this flaw needs local, low-privileged access), and remove non-administrator write permissions on directories that fall earlier in the resolved search path - particularly the root of C:\ and any world-writable folders in PATH - which closes the plant-a-binary vector but may break software that legitimately writes there. Review and, where possible, correct External Tools configuration entries so executable paths are properly quoted or relocated to paths without spaces, and monitor engineering workstations for unexpected executables appearing in Program Files parent directories.