Studio 5000 CVE-2026-9128

Exploitation requires local access to the machine running Studio 5000 Logix Designer with at least low-privilege authenticated rights (PR:L), plus the ability to write a malicious executable into a directory that appears earlier in the resolved, unquoted External Tools search path - the specific configuration element being an external-tool executable path that contains spaces and is stored unquoted. It is further gated by required active user interaction (UI:A): a legitimate user must actually invoke the affected external tool for the planted binary to run, and by high attack complexity (AC:H) and an attack requirement (AT:P), meaning a suitable writable path location must already exist. These limiting factors - no remote vector, needed pre-existing local foothold, and dependence on operator action - substantially narrow realistic exploitation despite the High severity rating.

This is a legitimate but conditional escalation/execution primitive rather than a mass-exploitable remote flaw. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:A) signals that an attacker must already have local, authenticated access to the engineering workstation, must win a non-trivial precondition (a writable directory earlier in the search path and the ability to plant a binary), and must wait for a legitimate user to invoke the affected external tool. No EPSS score was provided in the input and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; no POC was supplied either. The vendor-assigned 4.0 vector marks subsequent-system impact as changed (SC:H/SI:H/SA:H), which for an unquoted-path flaw is arguably generous - in practice code typically runs within the invoking user's own security context, so treat the cross-system impact claim with caution and verify against Rockwell advisory SD1783. Net: a real hardening priority for OT/ICS environments where engineering workstations are high-value, but not an internet-facing emergency.

An insider or an attacker who has already compromised a low-privileged account on an engineering workstation drops a malicious 'Program.exe' (or similarly named binary) into a writable directory that precedes the intended external tool in the search order. When an engineer later launches the affected External Tool from within Studio 5000 Logix Designer, Windows resolves the unquoted path to the planted executable and runs it with that engineer's privileges. No public POC was supplied, and the high attack complexity plus required user interaction mean the attacker must set up the payload and wait for legitimate tool use.