CVE-2026-9128

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer::::::::
	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer::::::::
	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer::::::::
	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:35.00:::::::*

History

No history.

Information

Published : 2026-07-14 16:17

Updated : 2026-08-25 16:59

NVD link : CVE-2026-9128

Mitre link : CVE-2026-9128

CVE.ORG link : CVE-2026-9128

JSON object : View

Products Affected

rockwellautomation

studio_5000_logix_designer

CWE

CWE-428

Unquoted Search Path or Element

{"id": "CVE-2026-9128", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9128", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T15:55:36.587930Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "PSIRT@rockwellautomation.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "PSIRT@rockwellautomation.com", "affectedData": [{"vendor": "Rockwell Automation", "product": "Studio 5000 Logix Designer", "versions": [{"status": "affected", "version": "V35.00, 34.00-34.02, 33.00-33.02, 32.00-32.04 and older"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T16:17:05.487", "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html", "tags": ["Vendor Advisory"], "source": "PSIRT@rockwellautomation.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "PSIRT@rockwellautomation.com", "description": [{"lang": "en", "value": "CWE-428"}]}], "descriptions": [{"lang": "en", "value": "A code execution security issue exists within\u00a0Studio 5000 Logix Designer\u00ae\u00a0due to an unquoted search path in the External Tools configuration. The executable paths specified in the external\u00a0tools\u00a0configuration\u00a0file are not properly quoted, and because these paths\u00a0contain\u00a0spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution\u00a0with the same permissions\u00a0of\u00a0the user running the application."}], "lastModified": "2026-08-25T16:59:58.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB77731A-DB59-4781-9C6F-0D79E3F58F8C", "versionEndExcluding": "32.05"}, {"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33431926-A063-4AA2-807E-394CF8FECCCE", "versionEndExcluding": "33.03", "versionStartIncluding": "33.00"}, {"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFB42E92-DA46-4130-B5CE-A9B81A7865B1", "versionEndExcluding": "34.03", "versionStartIncluding": "34.00"}, {"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:35.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25EF8390-E355-4C44-9D28-8086BC76F656"}], "operator": "OR"}]}], "sourceIdentifier": "PSIRT@rockwellautomation.com"}