CISA flags Rockwell Automation tool flaws that could let attackers run code as admin

By Atlas Watchline Staff · Regulatory · September 1, 2026

CISA said two vulnerabilities in Rockwell Automation’s Redundancy Module Configuration Tool could let a local attacker load a malicious DLL and run code with elevated privileges.

CISA on Sept. 1, 2026, published an advisory on two vulnerabilities in Rockwell Automation’s Redundancy Module Configuration Tool that could let a local attacker load a malicious DLL into an administrator-run process and execute code with elevated privileges.

CISA said the flaws are not remotely exploitable, but they could still give a local attacker administrator- or SYSTEM-level access if the right conditions are met. Rockwell Automation reported the issues to the agency and has released version 10.01.00 as the fix, CISA said.

What CISA said

CISA identified the issues as CVE-2026-9633 and CVE-2026-9634. The agency said CVE-2026-9633 affects Redundancy Module Configuration Tool 10.00.00, while CVE-2026-9634 affects versions 9.00.00 through 10.00.00.

Both flaws are described as incorrect default permissions, or CWE-276. CISA said the affected binaries, RM3ConfigTool.exe and RMConfigTool.exe, search directories in the system path for a required DLL. One or more of those directories may be writable by standard users.

In that scenario, CISA said, a local attacker could place a malicious DLL in a writable directory. If an administrator later runs the tool, the DLL could be loaded into the elevated process and execute with Administrator or SYSTEM privileges.

CISA listed the issues as high severity. It gave both a CVSS v3.1 base score of 7.3 and a CVSS v4.0 base score of 7. CISA also said no known public exploitation specifically targeting these vulnerabilities has been reported to the agency.

Background

CISA said the product is used in the Critical Manufacturing sector, is deployed worldwide, and has a U.S. headquarters. The agency’s advisory also said the vulnerabilities are not remotely exploitable.

Rockwell Automation’s advisory page, referenced by CISA, says users should install Redundancy Module Configuration Tool version 10.01.00. If customers cannot upgrade, CISA said they should use Rockwell Automation security best practices and consult Rockwell Automation Security Advisories.

What happens next

Users running affected versions will need to review the vendor fix and decide whether to upgrade or follow the mitigation guidance. CISA’s advisory and Rockwell Automation’s security advisories remain the main reference points for affected customers.

Sources

• CISA Cybersecurity Advisories

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.