CVE-2026-9633: RM3ConfigTool Privilege Escalation Vulnerability

CVE-2026-9633 Overview

CVE-2026-9633 is a local privilege escalation vulnerability in the Rockwell Automation Redundancy Module Configuration Tool (RM3ConfigTool.exe). The binary searches directories listed in the system PATH for a required Dynamic Link Library (DLL). One or more of these directories carry insecure default permissions that allow standard, non-administrator users to write files. A local attacker who plants a malicious DLL in a writable PATH directory can hijack the DLL search order. When an administrator later runs the tool, the planted DLL loads into the elevated process and executes with Administrator or SYSTEM privileges.

Critical Impact
Local low-privileged users can escalate to SYSTEM by planting a DLL that is loaded when an administrator runs RM3ConfigTool.exe.

Affected Products

Rockwell Automation Redundancy Module Configuration Tool (RM3ConfigTool.exe)
Refer to Rockwell Automation Security Advisory SD1800 for affected version ranges
Windows systems where the tool is installed with insecure PATH directory permissions

Discovery Timeline

2026-09-01 - CVE CVE-2026-9633 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-9633

Vulnerability Analysis

The flaw is classified under [CWE-276] Incorrect Default Permissions. The Redundancy Module Configuration Tool depends on an external DLL that is resolved through the Windows library search order. Instead of loading the DLL from a fixed, protected location, the process walks directories referenced by the system PATH environment variable.

One or more of those directories are created with permissions that grant write access to standard users. A low-privileged attacker can drop an attacker-controlled DLL matching the expected filename into such a directory. When an administrator subsequently launches RM3ConfigTool.exe, the loader locates the planted DLL before the legitimate one and maps it into the elevated process. Code inside DllMain or exported functions then executes in the security context of the administrator, typically yielding SYSTEM-level control on the host.

Root Cause

The root cause is a combination of two design defects. First, the application relies on the ambiguous Windows DLL search order rather than an absolute path or a signed-DLL policy. Second, the installer or a related component creates a PATH-listed directory with an Access Control List (ACL) that permits write access to non-privileged principals such as Authenticated Users or BUILTIN\Users. Either defect alone would be lower risk. Together they create a reliable local privilege escalation primitive.

Attack Vector

Exploitation requires local access with standard user rights and a subsequent administrator action to launch the tool. The attacker enumerates directories in the system PATH, tests each for write access, and identifies one that is both writable and searched before the legitimate DLL location. The attacker then writes a malicious DLL using the filename the tool loads. When an administrator runs RM3ConfigTool.exe, the loader resolves the malicious DLL, and the attacker's code executes with elevated privileges.

No network access is required. User interaction from an administrator is required to trigger the payload. See the Rockwell Automation Security Advisory SD1800 for authoritative technical details.

Detection Methods for CVE-2026-9633

Indicators of Compromise

Unexpected DLL files written by non-administrator accounts into directories listed in the system PATH.
New or modified DLLs in the RM3ConfigTool.exe installation directory or adjacent writable directories that lack a valid Authenticode signature.
RM3ConfigTool.exe process loading a module from a user-writable path rather than the tool's installation directory or System32.
Child processes spawned by RM3ConfigTool.exe that are inconsistent with normal tool operation, such as cmd.exe, powershell.exe, or rundll32.exe.

Detection Strategies

Audit ACLs on every directory referenced in the machine PATH and flag any directory writable by non-administrators.
Enable Sysmon Event ID 7 (Image Loaded) and alert on RM3ConfigTool.exe loading DLLs from paths outside its trusted installation directory.
Monitor file-create events for .dll files in PATH directories authored by standard user accounts.
Hunt for process creation events where RM3ConfigTool.exe is the parent and the child is an interactive shell or scripting host.

Monitoring Recommendations

Baseline the legitimate module set loaded by RM3ConfigTool.exe and alert on deviations.
Forward Sysmon and Windows Security event logs to a centralized analytics platform for correlation across hosts.
Track integrity level transitions where a file written by a Medium integrity process is later loaded by a High or System integrity process.

How to Mitigate CVE-2026-9633

Immediate Actions Required

Restrict execution of RM3ConfigTool.exe to administrators operating on hardened engineering workstations only.
Review every directory in the system PATH and remove write permissions for non-administrator principals.
Remove unnecessary or user-writable entries from the machine PATH variable entirely.
Inspect the tool's installation directory and adjacent PATH directories for unauthorized DLLs and remove any that are not vendor-signed.

Patch Information

Rockwell Automation has published guidance in Security Advisory SD1800. Apply the fixed release identified in that advisory as soon as it is available for your environment, and validate that the installer no longer creates world-writable directories on the system PATH.

Workarounds

Apply restrictive ACLs so that only Administrators and SYSTEM have write access to any directory in the machine PATH.
Enforce application allowlisting (Windows Defender Application Control or AppLocker) to block loading of unsigned DLLs into RM3ConfigTool.exe.
Launch the tool from an isolated administrative session on a dedicated jump host rather than from shared operator workstations.
Where feasible, uninstall the tool from systems that do not require redundancy module configuration.

bash

# Example: audit writable directories on the system PATH (PowerShell)
$env:Path -split ';' | ForEach-Object {
    if (Test-Path $_) {
        $acl = Get-Acl $_
        $acl.Access | Where-Object {
            $_.FileSystemRights -match 'Write|Modify|FullControl' -and
            $_.IdentityReference -match 'Users|Authenticated Users|Everyone'
        } | ForEach-Object {
            [PSCustomObject]@{
                Path     = $_
                Identity = $_.IdentityReference
                Rights   = $_.FileSystemRights
            }
        }
    }
}