← Vulnerability feed

Vulnerability record · CVE-2026-9128 · published 14 July 2026

CVE-2026-9128: Rockwellautomation studio 5000 logix designer unquoted search path vulnerability

Rockwellautomation · Studio 5000 Logix Designer

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.

7.3 CVSS 4.0 High EPSS 0.17% · top 94.6% CWE-428 · Unquoted search path
7.3CVSS 4.0 base score
0.17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
25 Aug 2026Last modified by NVD

Description

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html Vendor Advisory

Track CVE-2026-9128 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-22681Rockwell Logix Designer authentication bypass via weak key verificationRockwell Automation Studio 5000 Logix Designer (v21+) and RSLogix 5000 (v16-20) rely on a key to verify that Logix controllers are talking to genuine…KEVEPSS 64%analysed8.2CVE-2020-12034Rockwellautomation eds subsystem sql injection vulnerabilityProducts that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and …EPSS 1.3%7.3CVE-2026-9127Rockwellautomation studio 5000 logix designer incorrect authorization vulnerabilityA remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can all…EPSS 0.15%5.5CVE-2020-12038Rockwellautomation eds subsystem memory buffer overflow vulnerabilityProducts that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and …EPSS 2.5%5.4CVE-2026-9108Rockwellautomation studio 5000 logix designer path traversal vulnerabilityA path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The soft…EPSS 0.18%3.3CVE-2020-12025Rockwellautomation studio 5000 logix designer xml external entity (xxe) vulnerabilityRockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may a…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2026-9128), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.