Advisories › Rockwell Automation › ICSA-26-202-10
Rockwell Automation Studio 5000 Logix Designer: 3 CVEs, High 7.5
Summary
CISA reports 3 vulnerabilities in Rockwell Automation Studio 5000 Logix Designer. Weakness types: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Incorrect Authorization, Unquoted Search Path or Element. Successful exploitation of these vulnerabilities could allow for a local attacker to execute arbitrary files, alter configurations, or execute arbitrary code. Highest CVSS v3 score: 7.5 (High), not remotely exploitable per its CVSS vector.
What to do: Prioritize: Rockwell Automation recommends users to upgrade to the following: Studio 5000 Logix Designer: V37.00, 36.01, 35.02, 34.04, 33.04, 32.05 (CVE-2026-9108)
Why this matters for oil & gas: Rockwell Automation (ControlLogix, FactoryTalk, PlantPAx) is common on facilities and compressor stations; Affected products include Studio 5000.
At a glance
- Vendor
- Rockwell Automation
- Products
- Studio 5000 Logix Designer
- CVEs
- CVE-2026-9108, CVE-2026-9127, CVE-2026-9128
- Highest CVSS v3
- 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-9108 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 6.7 | – | No | A path traversal security issue exists within Studio 5000 Logix Designer due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD … |
| CVE-2026-9127 | Incorrect Authorization | 7.5 | – | No | A remote code execution security issue exists within Studio 5000 Logix Designer due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts… |
| CVE-2026-9128 | Unquoted Search Path or Element | 7.5 | – | No | A code execution security issue exists within Studio 5000 Logix Designer due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attac… |
Affected products (12)
- Rockwell Automation Studio 5000 Logix Designer: V36.00
- Rockwell Automation Studio 5000 Logix Designer: V35.00
- Rockwell Automation Studio 5000 Logix Designer: V35.01
- Rockwell Automation Studio 5000 Logix Designer: >=V34.00|<=V34.03
- Rockwell Automation Studio 5000 Logix Designer: >=V33.00|<=V33.03
- Rockwell Automation Studio 5000 Logix Designer: >=V32.00|<=V32.04
- Rockwell Automation Studio 5000 Logix Designer: V34.00
- Rockwell Automation Studio 5000 Logix Designer: V34.01
- Rockwell Automation Studio 5000 Logix Designer: V33.00
- Rockwell Automation Studio 5000 Logix Designer: V33.02
- Rockwell Automation Studio 5000 Logix Designer: >=V34.00|<=V34.02
- Rockwell Automation Studio 5000 Logix Designer: >=V33.00|<=V33.02
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Rockwell Automation recommends users to upgrade to the following: Studio 5000 Logix Designer: V37.00, 36.01, 35.02, 34.04, 33.04, 32.05 (CVE-2026-9108)
- Mitigation: Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight). link
- Mitigation: For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html. link
- Vendor Fix: Studio 5000 Logix Designer: V36.00, 35.01, 34.02, 33.02, 32.05 (CVE-2026-9127)
- Vendor Fix: Studio 5000 Logix Designer: V36.00, 35.01, 34.03, 33.03, 32.05 (CVE-2026-9128)
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.