Rockwell Automation has patched three vulnerabilities in its Studio 5000 Logix Designer software—the Windows-based engineering platform for Logix 5000 controllers—that could let a malicious ACD project file write arbitrary files to an engineer’s PC or allow a local attacker to hijack external tool paths for code execution. The fixes, announced by CISA on July 21, 2026, affect a wide span of versions from 32.00 to 36.00, with no known exploits in the wild but a high potential for targeted attacks against critical manufacturing.
What Got Fixed: A Flaw Trio with Nuanced Patching
Studded with three CVEs, the advisory demands more than a straightforward update. Different sub-versions are vulnerable to different issues, and the fix path isn’t always the latest release. Here’s what you’re up against:
CVE-2026-9108 – Path Traversal in ACD Project Files
A crafted project file can escape its intended extraction directory when opened, writing files anywhere the current user has write access. With a CVSSv3.1 score of 6.7, it’s the lowest-severity bug of the three, but its ability to plant malware or overwrite configuration files silently makes it a serious concern.
CVE-2026-9127 – Incorrect Authorization in External Tools
An authenticated user can modify the paths to external tools configured in Studio 5000, pointing them at a malicious executable. This 7.5-severity flaw turns a trusted menu click into code execution.
CVE-2026-9128 – Unquoted Search Path in External Tools
A classic Windows pitfall: if an executable path contains a space and isn’t quoted, an attacker can place a similarly named executable earlier in the search order. Also rated 7.5, this can be exploited by anyone who can drop a file into a writable folder.
The version labyrinth is real. For example, if you’re running 34.02, you’re protected against CVE-2026-9127 but still exposed to the other two. Only an exact inventory tells the whole story:
| CVE | Affected Examples (not exhaustive) | Fixed In (by branch) |
|---|---|---|
| CVE-2026-9108 | 32.00-32.04, 33.00-33.03, 34.00-34.03, 35.00-35.01, 36.00 | 32.05, 33.04, 34.04, 35.02, 36.01, 37.00 |
| CVE-2026-9127 | 32.00-32.04, 33.00-33.01, 34.00-34.01, 35.00 | 32.05, 33.02, 34.02, 35.01, 36.00 |
| CVE-2026-9128 | 32.00-32.04, 33.00-33.02, 34.00-34.02, 35.00 | 32.05, 33.03, 34.03, 35.01, 36.00 |
Note that version 36.00 was only affected by the path traversal flaw, and the brand-new version 37.00 carries all fixes. If you’re still on a 32.x or 33.x branch, you’ll need to weigh the operational cost of jumping to a newer branch against applying the point fix—Rockwell provides patches across several major releases for exactly this reason.
Your Engineering Workstation Is a Target
Don’t let the “local attacker” label lull you into complacency. In an industrial setting, a compromised engineering laptop can be the gateway to altered controller logic, unauthorized production changes, and safety risks. These machines are often shared, hold credentials, and have direct programming access to multiple controllers. An adversary who gains a foothold—through a phishing email, a USB drive, or a contractor’s device—can exploit these flaws to maintain persistence or move laterally.
The project-file traversal bug (CVE-2026-9108) is especially insidious. Engineering teams routinely exchange ACD files for commissioning, troubleshooting, or vendor support. A malicious file arriving via email or a shared folder could go unnoticed until it’s opened in Studio 5000, silently dropping payloads into startup folders or overwriting legitimate utilities.
The External Tools flaws turn everyday workflows into attack vectors. Many engineers launch ancillary programs—like communication drivers or diagnostic tools—right from Studio 5000’s menus. If an attacker can alter those paths, every click becomes a potential compromise. Because the activity originates from a signed, trusted application, it easily blends into normal operations.
It’s Not Just About PLCs—This Is a Windows Security Problem
The three bugs are textbook Windows hardening issues: path traversal, weak permissions on configuration files, and unquoted service paths. They underscore why an OT workstation can’t be treated like a kiosk. Basic Windows security practices directly reduce the risk:
- Application allowlisting: With AppLocker or Windows Defender Application Control, even if a malicious executable lands on the disk, it won’t run unless explicitly allowed. Validate rules against normal Studio 5000 and FactoryTalk processes to avoid breaking engineering workflows.
- Least privilege: Engineers should operate with standard user accounts for daily work, escalating only for software installations or configuration changes. Shared local admin accounts are a risk multiplier.
- File and folder permissions: Lock down the directories where external tool paths are stored and where Studio 5000 extracts project files. Standard users shouldn’t be able to write to those locations.
- Monitoring: Watch for child processes spawned by Logix Designer that don’t match an approved baseline, especially from temporary folders or user profiles.
These measures aren’t optional; they’re compensating controls that buy you time when patches can’t be applied immediately.
How We Got Here: A Short History of Trusting the Tool
Studio 5000 Logix Designer (the successor to RSLogix 5000) has been the default development environment for Allen‑Bradley controllers for decades. It’s a complex piece of software that integrates with many other Rockwell and third-party components—FactoryTalk, RSLinx, asset management tools. That extensive integration means configuration files, external tool paths, and project parsing routines have grown organically, sometimes without the strict input validation we expect today.
Unquoted search paths have plagued Windows applications for years, and OT software is no exception. Path traversal in project files isn’t new either; many industrial control system design tools have suffered similar flaws as they added scripting or export features. The difference here is the operational context: when a CAD file is malicious, you lose a drawing; when a PLC project is malicious, you could lose production.
CISA’s advisory note that “no known public exploitation” exists is reassuring, but it’s also a narrow window. Once the patches are available, attackers can reverse‑engineer them to develop exploits. The window to patch before that happens is measured in days or weeks, not months.
Your Patch Plan: Don’t Just Blindly Update
Rushing to install the latest Studio 5000 build on a Friday afternoon is a recipe for a plant outage. Here’s a phased approach that respects both security and operations:
- Inventory every installation. Use your endpoint management tools to pull the exact version and build number of Studio 5000 from each engineering workstation. A generic “v34” isn’t enough—you need to know if it’s 34.01, 34.02, etc.
- Map vulnerabilities. Create a spreadsheet: for each host, list which of the three CVEs it’s exposed to and what fixed version is available for that branch. The table above will help.
- Check compatibility. Before upgrading, verify that the target fix version is compatible with your deployed controller firmware, any installed Rockwell add‑ons (like Motion or Process Objects), and your FactoryTalk Services Platform. Rockwell’s Product Compatibility and Download Center is your friend.
- Test in a staging environment. Ideally, clone a representative engineering workstation or use a sandbox that mirrors your production setup. Open a range of project files, test online edits, launch external tools, and verify that all communication paths work.
- Apply compensating controls now. While you’re planning the patch rollout:
- Restrict who can open or modify external tool configurations: make the configuration file read‑only for standard users.
- Configure AppLocker or WDAC in audit mode, then tighten rules to allow only known‑good executables.
- Advise engineers to treat project files from untrusted sources with suspicion—scan them with antivirus, open them on isolated machines first, and verify file hashes when possible. - Schedule the patch under change control. OT change management exists for a reason. Coordinate with plant schedulers, maintenance leads, and operations to pick a window. Have a rollback plan: snapshot the VM, back up all engineering files, and know how to revert the Studio 5000 installation.
- Monitor after patching. For several weeks, keep an eye on event logs for unusual process creation from Logix Designer, unexpected file writes, or failed application control audits. If something breaks, you’ll catch it early.
If you’re a contractor or system integrator, the same rules apply to your own laptops. A compromised contractor machine can infect multiple customer sites. Ensure your devices are patched and enforce the same hardening standards you’d expect from a large plant.
Outlook: What to Watch Next
Rockwell may release further patches if the initial fixes prove incomplete or if compatibility issues arise. The CISA advisory is likely to be updated if exploitation is detected. More importantly, treat this as a stress test of your OT vulnerability management program. If you can’t answer “where is every Studio 5000 install and what version is it?” today, invest in that capability before the next advisory hits.
Questions you should be asking now:
- Do we have an accurate inventory of all engineering workstations and their exact software versions?
- Which workstations are still exposed to one or more of these CVEs?
- What is our agreed‑upon patch timeline, and who is accountable?
- Can we trust that every project file we open hasn’t been tampered with?
- Are we logging and monitoring the right events to catch abuse of these features?
This set of vulnerabilities is not a sky‑is‑falling scenario, but it’s a clear signal that the software toolchain in critical manufacturing needs the same rigorous security attention as the controllers themselves. Patch deliberately, harden everywhere else, and keep the engineering workstation a trusted instrument—not an open door.