CVE-2026-9108: Studio 5000 Path Traversal Vulnerability

CVE-2026-9108 Overview

CVE-2026-9108 is a path traversal vulnerability in Rockwell Automation Studio 5000 Logix Designer®. The software fails to sanitize or validate file names embedded within ACD project files during the project opening procedure. Attackers can craft a malicious ACD project file containing path traversal sequences that escape the intended extraction directory. Successful exploitation writes arbitrary files to attacker-controlled locations on the file system. This behavior can lead to arbitrary code execution when written files overwrite executable content or scheduled task payloads. The weakness is classified as [CWE-22], improper limitation of a pathname to a restricted directory.

Critical Impact
A crafted ACD project file can write arbitrary files outside the extraction directory, enabling code execution on engineering workstations that open the malicious project.

Affected Products

Rockwell Automation Studio 5000 Logix Designer®
ACD project file handler within the Studio 5000 project opening procedure
Engineering workstations running vulnerable Studio 5000 versions

Discovery Timeline

2026-07-14 - CVE-2026-9108 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-9108

Vulnerability Analysis

Studio 5000 Logix Designer stores project data in ACD files, which are container archives that the application unpacks when a project is opened. The vulnerability stems from missing validation of embedded file names during extraction. An attacker crafts an ACD file whose internal entries contain relative path sequences such as ..\ to redirect writes outside the intended output directory. When the engineer opens the project, the application writes those entries to attacker-chosen locations. Because the extraction runs with the privileges of the local user, files can be placed in Startup folders, user profile directories, or application plugin paths. Placement in an auto-loaded location results in code execution the next time the target file is invoked.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory during ACD archive extraction. The extraction routine trusts embedded file names and does not canonicalize paths or reject entries that traverse outside the destination. This is a classic Zip Slip class defect applied to a proprietary project file format.

Attack Vector

Exploitation requires local access, low privileges, user interaction, and defeating an additional attack requirement. An attacker must deliver a malicious ACD file through email, shared drives, or supply chain channels. The victim must open the file in Studio 5000 Logix Designer for extraction to occur.

No verified public proof-of-concept code is available. See the Rockwell Automation Security Advisory SD1783 for vendor-provided technical details.

Detection Methods for CVE-2026-9108

Indicators of Compromise

Files written outside the expected Studio 5000 project extraction directory following an ACD file open operation
New or modified executables, DLLs, or scripts appearing in user Startup folders shortly after Studio 5000 activity
ACD project files received from untrusted sources or unexpected external senders
Unexpected child processes spawned by RSLogix5000.exe or Studio 5000 helper processes

Detection Strategies

Monitor file creation events by Studio 5000 processes and alert on writes outside the project workspace directory
Inspect ACD files at the mail and web gateway for archive entries containing ..\ or ../ path traversal sequences
Correlate ACD file open events with subsequent process launches from user-writable auto-run locations

Monitoring Recommendations

Enable process and file audit logging on engineering workstations that run Studio 5000 Logix Designer
Forward endpoint telemetry to a central analytics platform for retrospective hunting on ACD-related file writes
Track distribution channels for ACD project files, including email attachments, USB media, and shared network folders

How to Mitigate CVE-2026-9108

Immediate Actions Required

Apply the fixed Studio 5000 Logix Designer version identified in Rockwell Automation advisory SD1783
Restrict opening of ACD project files to those from verified, trusted internal sources
Isolate engineering workstations from general corporate email and web browsing to reduce delivery paths
Enforce least-privilege user accounts on engineering workstations to limit the impact of file writes

Patch Information

Rockwell Automation has published remediation guidance in Security Advisory SD1783. Consult the advisory for the specific fixed versions and upgrade instructions applicable to your Studio 5000 Logix Designer deployment.

Workarounds

Validate the origin and integrity of every ACD file before opening it in Studio 5000
Open untrusted ACD files only inside isolated virtual machines with no network access to production systems
Apply application allowlisting to block execution from user Startup folders and other user-writable auto-run locations
Segment engineering workstations from operational technology networks to contain any post-exploitation activity

bash

# Configuration example: block execution from user Startup folders via Windows AppLocker
# Create a deny rule for the per-user Startup path
$startupPath = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\*"
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny -Path $startupPath