CVE-2026-9634

Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe) locates a required DLL by searching directories in the system PATH, and due to incorrect default permissions (CWE-276) one or more of those directories may be writable by standard, non-administrator users. A local attacker with low-privileged access to the machine can plant a malicious DLL in such a directory, and when an administrator subsequently launches the tool, the DLL is loaded into the elevated process and executes with Administrator/SYSTEM privileges. The result is local privilege escalation giving the attacker high-impact control over the confidentiality, integrity, and availability of the host, though the attack requires an administrator to run the tool (user interaction is part of the exploit conditions). Affected users are organizations running the Redundancy Module Configuration Tool on Windows engineering or administrator workstations; specific affected version ranges were not provided in the available data. No public proof-of-concept, CISA KEV listing, or known exploitation exists, and EPSS currently estimates only a 0.1% probability of exploitation in the next 30 days.

What to do: Until Rockwell publishes a fix, check the access-control lists on directories in the system PATH and restrict write access to administrators only, and avoid launching RMConfigTool.exe while untrusted local users can write to those directories. Monitor Rockwell Automation's security advisory (CNA: [email protected]) for the definitive affected-version list and an updated release, and upgrade when available. Prioritize remediation on shared, multi-user engineering workstations where the tool is installed, since exploitation requires an existing local low-privileged foothold.