Rockwell Automation ControlFLASH
CISA advisory for CVE-2026-12663 (CVSS 7.3) in Rockwell Automation ControlFLASH <=V15.07: world-writable install directory enables local code execution.
Rockwell Automation reported CVE-2026-12663 in ControlFLASH V15.07 and earlier, where the installer grants write permissions on the installation directory to the Everyone group. An attacker could plant malicious code there and execute it at the logged-in user's privilege level. The issue is local only and not remotely exploitable; no public exploitation has been reported to CISA.
- Everyone-group write permissions on the installation directory enable arbitrary code execution
- Local attack vector only; not exploitable remotely
- Affects ControlFLASH V15.07 and earlier across manufacturing, energy, and water sectors
- CVEs
- CVE-2026-12663
- Vendors
- Rockwell AutomationCISA
- Products
- ControlFLASH
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-12663 | Everyone-Group Write Permissions in Rockwell ControlFLASH Allow Local Code Execution | 7.0 | <1% |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could give an attacker the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level. The following versions of Rockwell Automation ControlFLASH are affected: ControlFLASH <=V15. 07 (CVE-2026-12663) CVSS Vendor Equipment Vulnerabilities v3 7.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.