CVE-2026-9634: Redundancy Module Config Tool Privilege Escalation

CVE-2026-9634 Overview

CVE-2026-9634 is a local privilege escalation vulnerability in the Rockwell Automation Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches system path directories for a required Dynamic Link Library (DLL). One or more of these directories carry incorrect default permissions that allow standard, non-administrator users to write files to them. A local attacker who plants a malicious DLL in such a directory can hijack the DLL search path. When an administrator later runs the tool, the planted DLL loads into the elevated process and executes with Administrator or SYSTEM privileges. The weakness is categorized under [CWE-276: Incorrect Default Permissions].

Critical Impact
A local low-privileged user can achieve Administrator or SYSTEM code execution by planting a malicious DLL that gets loaded when an administrator runs RMConfigTool.exe.

Affected Products

Rockwell Automation Redundancy Module Configuration Tool (RMConfigTool.exe)
Refer to Rockwell Automation Security Advisory SD1800 for the affected version list
Windows systems where the tool is installed with insecure directory permissions on the system PATH

Discovery Timeline

2026-09-01 - CVE-2026-9634 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-9634

Vulnerability Analysis

The vulnerability is a DLL search path hijacking issue rooted in incorrect default permissions on directories referenced by the Windows system PATH. When RMConfigTool.exe starts, Windows resolves imports for required DLLs by walking the standard search order, which includes directories listed in the PATH environment variable. If any of those directories are writable by non-administrator users, an attacker can drop a crafted DLL that matches the name of a legitimate dependency.

Execution is triggered when a privileged user launches the tool. Because the attacker cannot elevate on their own, this issue requires an administrator to run RMConfigTool.exe after the malicious DLL has been staged. Once loaded, the DLL executes inside the tool's process with the caller's token, yielding Administrator or SYSTEM level code execution and full compromise of confidentiality, integrity, and availability on the local host.

Root Cause

The root cause is [CWE-276: Incorrect Default Permissions] on one or more directories present in the system PATH. These directories inherit write access for standard users, violating the least privilege principle for locations searched during library loading. The tool compounds the issue by not pinning DLL resolution to a trusted absolute path or using safe loading flags such as LOAD_LIBRARY_SEARCH_SYSTEM32.

Attack Vector

The attack vector is local and requires low privileges plus user interaction from an administrator. An attacker with a standard account writes a malicious DLL, named to match a dependency of RMConfigTool.exe, into a writable PATH directory that precedes the legitimate location in the search order. The attacker then waits for or induces an administrator to run the configuration tool. On launch, the Windows loader binds to the attacker-controlled DLL, executing the payload with elevated privileges. No verified public exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Rockwell Automation Security Advisory SD1800 for vendor technical details.

Detection Methods for CVE-2026-9634

Indicators of Compromise

Unexpected DLL files present in writable directories referenced by the system PATH, particularly with names matching common Windows or Rockwell dependencies.
RMConfigTool.exe loading modules from non-standard locations such as user-writable application directories rather than System32 or the tool's install path.
New child processes, service installations, or credential dumping activity spawned from RMConfigTool.exe shortly after an administrator launches it.

Detection Strategies

Enumerate every directory in the system PATH and audit access control lists for entries granting write permissions to Users, Authenticated Users, or Everyone.
Enable Windows Sysmon Event ID 7 (Image Loaded) and alert on DLL loads by RMConfigTool.exe from paths outside its trusted install directory and System32.
Correlate process creation events for RMConfigTool.exe with subsequent unusual behavior such as PowerShell, cmd.exe, or LSASS access from the same process tree.

Monitoring Recommendations

Monitor file creation events in PATH directories, especially by low-privileged accounts writing .dll files.
Track privileged use of the Redundancy Module Configuration Tool and require change control approval before administrators execute it.
Baseline the legitimate DLL dependencies of RMConfigTool.exe and alert on any deviation in loaded module paths or hashes.

How to Mitigate CVE-2026-9634

Immediate Actions Required

Apply the vendor guidance published in Rockwell Automation Security Advisory SD1800 as soon as the fixed version is available.
Audit every directory in the system and user PATH and remove write permissions for non-administrator users on directories that should not be user-writable.
Restrict use of RMConfigTool.exe to administrators and only execute it from validated engineering workstations.

Patch Information

Refer to the Rockwell Automation Security Advisory SD1800 for the current list of fixed versions and vendor remediation steps. Deploy the vendor-provided update to affected systems as part of standard change management for operational technology environments.

Workarounds

Reset access control lists on affected PATH directories so that only Administrators and SYSTEM have write access, for example using icacls to remove Users:(W) entries.
Remove unnecessary or third-party writable directories from the system PATH until the patch is applied.
Enforce application allowlisting (such as Windows Defender Application Control or AppLocker) to block execution of unsigned DLLs loaded from user-writable locations.
Require administrators to launch RMConfigTool.exe only from a hardened jump host where the PATH is fully controlled.

bash

# Configuration example: remove standard user write access from a PATH directory
icacls "C:\Path\To\WritableDir" /remove:g "BUILTIN\Users"
icacls "C:\Path\To\WritableDir" /inheritance:r
icacls "C:\Path\To\WritableDir" /grant:r "BUILTIN\Administrators:(OI)(CI)F" "NT AUTHORITY\SYSTEM:(OI)(CI)F"