CISA flags Rockwell Automation ControlFLASH flaw, urges update to 15.08

By Atlas Watchline Staff · Regulatory · September 3, 2026

CISA said a vulnerability in Rockwell Automation ControlFLASH could let a local user run code on a target machine. It said version 15.08 fixes the issue.

CISA issued an advisory on Rockwell Automation ControlFLASH that identifies CVE-2026-12663, a local code-execution flaw affecting versions through V15.07.

CISA said successful exploitation could let an attacker run code on the target machine at the logged-in user’s permission level. The agency also said the flaw is not remotely exploitable and that it had not seen known public exploitation targeting the vulnerability at the time of publication.

According to the advisory, the problem stems from the installer granting write permissions to the “Everyone” group on a product installation directory. CISA said the affected product is Rockwell Automation ControlFLASH, used worldwide in Critical Manufacturing, Energy, and Water and Wastewater sectors.

CISA listed the issue under CWE-306, Missing Authentication for Critical Function. It gave the flaw a CVSS v3.1 base score of 7.3, rated HIGH, and a CVSS v4.0 base score of 7, also rated HIGH.

Rockwell Automation corrected the issue in software version 15.08, according to the advisory. CISA said users should update to the newest version when possible.

For systems that cannot be upgraded, CISA relayed Rockwell Automation’s mitigation steps to remove the Everyone group from the C:\Program Files (x86)\ControlFLASH\0001 folder. The advisory also points readers to Rockwell Automation security and support material for additional mitigation guidance.

CISA said Rockwell Automation reported the vulnerability to the agency. The advisory was initially released on 2026-09-03.

Sources

• CISA Cybersecurity Advisories

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.