CVE-2026-9128: Studio 5000 Logix Designer RCE Vulnerability

CVE-2026-9128 Overview

CVE-2026-9128 is a code execution vulnerability in Rockwell Automation Studio 5000 Logix Designer®. The flaw stems from an unquoted search path [CWE-428] in the External Tools configuration. Executable paths in the configuration file contain spaces but are not enclosed in quotes. Windows may then resolve these paths to unintended executables placed earlier in the search order.

An attacker who can write to a directory along the search path can plant a malicious binary. When a user launches the affected external tool, the operating system executes the attacker-controlled file with the privileges of the current user.

Critical Impact
Local attackers can achieve arbitrary code execution in the security context of the Studio 5000 Logix Designer user by placing a crafted executable in an unprotected directory on the search path.

Affected Products

Rockwell Automation Studio 5000 Logix Designer®
Engineering workstations running the affected External Tools configuration
Refer to Rockwell Automation Security Advisory SD1783 for specific affected versions

Discovery Timeline

2026-07-14 - CVE-2026-9128 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-9128

Vulnerability Analysis

The vulnerability is classified as CWE-428: Unquoted Search Path or Element. Studio 5000 Logix Designer references external tool executables through a configuration file. When Windows receives a command line containing a path with spaces and no surrounding quotation marks, the loader parses the string as a series of potential candidate paths. It attempts to launch each candidate in sequence until one resolves successfully.

For example, a configured path such as C:\Program Files\Vendor Name\tool.exe may be interpreted first as C:\Program.exe, then C:\Program Files\Vendor.exe, and so on. If any earlier candidate exists on disk, the loader executes it instead of the intended binary.

Exploitation requires local access and the ability to write to a directory earlier in the resolution order. The attacker also relies on user interaction to invoke the affected external tool. Successful exploitation yields arbitrary code execution with the same permissions as the Studio 5000 Logix Designer user.

Root Cause

The root cause is missing quotation marks around executable path strings stored in the External Tools configuration file. The application passes these unquoted strings to the Windows process creation APIs, which then apply the standard space-delimited parsing behavior described in the Microsoft documentation for CreateProcess.

Attack Vector

The attack vector is local. An attacker must already have low-privilege code execution on the engineering workstation and write access to a directory along an unquoted path. The attacker plants a malicious executable named to match one of the parsing candidates. When an operator or engineer launches the affected external tool, the planted binary executes in place of the legitimate tool.

Refer to the Rockwell Automation Security Advisory for verified technical details. No public proof-of-concept exploit is available at this time.

Detection Methods for CVE-2026-9128

Indicators of Compromise

Unexpected executables located directly in root paths such as C:\Program.exe or in the first token of any Program Files subdirectory
New or modified binaries in directories along the External Tools configuration search path
Process creation events where the parent is Studio 5000 Logix Designer but the child image path does not match the intended external tool
Unusual writes to configuration files controlling External Tools entries

Detection Strategies

Audit all Studio 5000 External Tools configuration entries and flag any executable path that contains spaces and is not enclosed in quotation marks
Enumerate the filesystem for stray .exe files at each candidate location produced by unquoted path parsing
Correlate process creation telemetry with the expected External Tools binary paths and alert on divergence
Monitor file integrity on directories that fall within the parsing search order of engineering applications

Monitoring Recommendations

Enable Windows Security event ID 4688 with command-line auditing on all engineering workstations
Forward Sysmon EventID 1 (process creation) and EventID 11 (file creation) events to a central analytics platform
Alert on any process launched from a non-standard path with Studio 5000 Logix Designer as the parent process
Baseline expected child processes of Logix Designer and investigate deviations

How to Mitigate CVE-2026-9128

Immediate Actions Required

Review the External Tools configuration in Studio 5000 Logix Designer and manually wrap each executable path containing spaces in double quotation marks
Restrict write permissions on C:\, C:\Program Files\, and other directories along the parsing search path to administrators only
Limit local logon rights on engineering workstations to authorized personnel
Apply the vendor-provided update once available from Rockwell Automation

Patch Information

Rockwell Automation has published details in Security Advisory SD1783. Consult the advisory for fixed version numbers and download instructions. Apply updates during the next scheduled maintenance window for operational technology environments.

Workarounds

Manually quote all executable paths in the External Tools configuration file until a patched release is deployed
Remove or lock write permissions on directories that fall along unquoted path resolution candidates
Enforce application allowlisting to prevent execution of unapproved binaries from user-writable locations
Run Studio 5000 Logix Designer under least-privilege accounts to limit the impact of successful exploitation

bash

# Configuration example: enforce quoted paths in External Tools entries
# Before (vulnerable):
#   Command=C:\Program Files\Vendor Name\tool.exe
# After (mitigated):
#   Command="C:\Program Files\Vendor Name\tool.exe"