CVE-2026-12663: ControlFLASH RCE Vulnerability

CVE-2026-12663 Overview

CVE-2026-12663 is an insecure permissions vulnerability in Rockwell Automation ControlFLASH™. The installer grants write permissions to the Everyone group on a product installation directory. Any authenticated local user can replace or plant executable files in that directory. When a privileged user or scheduled process later executes those files, the attacker's code runs at the caller's permission level.

The issue is tracked under CWE-306: Missing Authentication for Critical Function and requires local access with low privileges plus user interaction.

Critical Impact

A local attacker can achieve arbitrary code execution in the context of any user who runs affected ControlFLASH binaries, potentially compromising industrial firmware update workflows.

Affected Products

• Rockwell Automation ControlFLASH™
• Refer to the Rockwell Automation Security Advisory SD1793 for exact affected versions
• Industrial control system workstations running the affected installer

Discovery Timeline

• 2026-09-01 - CVE-2026-12663 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-12663

Vulnerability Analysis

ControlFLASH™ is Rockwell Automation's firmware update utility for programmable logic controllers and other industrial devices. During installation, the setup routine applies an access control list (ACL) to the product installation directory that grants write access to the built-in Everyone principal. This ACL persists after installation completes.

Because any local account inherits Everyone membership, non-administrative users can modify files inside a directory that will later be executed by administrators or SYSTEM-level services. The vulnerability falls under the Local Code Execution and Insecure Permissions categories.

Root Cause

The root cause is an overly permissive ACL applied by the installer. Standard Windows installation guidance restricts write access on Program Files subdirectories to Administrators and SYSTEM. The ControlFLASH installer instead assigns write rights to Everyone, violating the principle of least privilege and creating a persistent trust boundary violation between low-privileged users and privileged execution contexts.

Attack Vector

An attacker with an authenticated local session on the affected workstation locates writable executables or dynamic link libraries (DLLs) inside the ControlFLASH installation directory. The attacker replaces a legitimate binary or plants a malicious DLL that satisfies the search order of a legitimate ControlFLASH component. When an administrator subsequently launches ControlFLASH to update device firmware, the planted code executes with the administrator's privileges. Exploitation requires user interaction, as reflected in the CVSS 4.0 vector UI:P, but no elevated privileges are required to plant the payload. See the Rockwell Automation Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-12663

Indicators of Compromise

• Unexpected changes to file hashes of executables or DLLs within the ControlFLASH installation directory
• New or modified files in the ControlFLASH directory tree written by non-administrative accounts
• ControlFLASH processes loading DLLs from unusual paths or with invalid digital signatures
• Child processes spawned by ControlFLASH binaries that do not match legitimate firmware update workflows

Detection Strategies

• Audit the ACL on the ControlFLASH installation directory using icacls and flag any entry granting Everyone write, modify, or full control access
• Enable Windows object access auditing (Event ID 4663) on the ControlFLASH directory to log write operations by non-administrative principals
• Correlate process execution telemetry with file-write events targeting the ControlFLASH directory to identify plant-then-execute sequences

Monitoring Recommendations

• Baseline the file inventory and hashes of the ControlFLASH installation directory and alert on deviations
• Monitor Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) for the installation path
• Review parent-child process relationships for ControlFLASH.exe and related binaries to detect anomalous child processes

How to Mitigate CVE-2026-12663

Immediate Actions Required

• Remove the Everyone write ACL from the ControlFLASH installation directory and restrict write access to Administrators and SYSTEM
• Restrict interactive logon on engineering workstations to authorized operators and administrators only
• Verify integrity of existing ControlFLASH binaries against vendor-supplied hashes before next use
• Apply the vendor patch referenced in Rockwell Automation advisory SD1793 as soon as it is available for your deployed version

Patch Information

Rockwell Automation has published remediation guidance in Security Advisory SD1793. Administrators should consult the advisory for the specific fixed version of ControlFLASH™ that removes the insecure directory ACL and apply the update on all affected engineering workstations.

Workarounds

• Manually correct the directory ACL using icacls "C:\Path\To\ControlFLASH" /remove:g Everyone and re-apply appropriate Administrators and SYSTEM permissions
• Segment engineering workstations running ControlFLASH from general-purpose user environments to limit local attacker access
• Enforce application allowlisting so that only signed, vendor-approved ControlFLASH binaries execute on the workstation

# Configuration example: remediate the insecure ACL on the ControlFLASH directory
icacls "C:\Program Files (x86)\ControlFLASH" /remove:g "Everyone"
icacls "C:\Program Files (x86)\ControlFLASH" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
icacls "C:\Program Files (x86)\ControlFLASH" /inheritance:r