← Vulnerability feed

Vulnerability record · CVE-2026-9127 · published 14 July 2026

CVE-2026-9127: Rockwellautomation studio 5000 logix designer incorrect authorization vulnerability

Rockwellautomation · Studio 5000 Logix Designer

A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.

7.3 CVSS 4.0 High EPSS 0.15% · top 96.3% CWE-863 · Incorrect authorization
7.3CVSS 4.0 base score
0.15%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
25 Aug 2026Last modified by NVD

Description

A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html Vendor Advisory

Track CVE-2026-9127 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-22681Rockwell Logix Designer authentication bypass via weak key verificationRockwell Automation Studio 5000 Logix Designer (v21+) and RSLogix 5000 (v16-20) rely on a key to verify that Logix controllers are talking to genuine…KEVEPSS 64%analysed8.2CVE-2020-12034Rockwellautomation eds subsystem sql injection vulnerabilityProducts that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and …EPSS 1.3%7.3CVE-2026-9128Rockwellautomation studio 5000 logix designer unquoted search path vulnerabilityA code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The exe…EPSS 0.17%5.5CVE-2020-12038Rockwellautomation eds subsystem memory buffer overflow vulnerabilityProducts that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and …EPSS 2.5%5.4CVE-2026-9108Rockwellautomation studio 5000 logix designer path traversal vulnerabilityA path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The soft…EPSS 0.18%3.3CVE-2020-12025Rockwellautomation studio 5000 logix designer xml external entity (xxe) vulnerabilityRockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may a…EPSS 1.5%9.1CVE-2026-71362Adobe commerce incorrect authorization vulnerabilityAdobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vul…KEVEPSS 88%8.8CVE-2026-42016JFrog Artifactory token scope bypass enables privilege escalationJFrog Artifactory (Self Hosted) before 7.133.11 validates a token's signature and issuer but not its scope, so a token can be used for actions beyond…KEVEPSS 8.6%analysed

Source: NIST National Vulnerability Database (record CVE-2026-9127), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.