How severe is CVE-2026-9127?

CVE-2026-9127 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over local access with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-9127 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-9127?

CVE-2026-9127 primarily affects Rockwellautomation Studio 5000 Logix Designer. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-9127?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-9127 published?

CVE-2026-9127 was published on 2026-07-14 and last updated on 2026-08-25.

CVE-2026-9127

CVE-2026-9127 is a high-severity vulnerability in Rockwellautomation Studio 5000 Logix Designer with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 7.3
EPSS exploit prediction: 0% (4th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-863
Affected product: Rockwellautomation Studio 5000 Logix Designer
Published: 2026-07-14
Last modified: 2026-08-25

Description

A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.

Frequently asked questions

What is CVE-2026-9127?: A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.
How severe is CVE-2026-9127?: CVE-2026-9127 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over local access with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-9127 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-9127?: CVE-2026-9127 primarily affects Rockwellautomation Studio 5000 Logix Designer. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-9127?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-9127 published?: CVE-2026-9127 was published on 2026-07-14 and last updated on 2026-08-25.

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html

Affected products (2)

cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*
cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:35.00:*:*:*:*:*:*:*

More vulnerabilities in Rockwellautomation Studio 5000 Logix Designer

CVE-2021-22681 — Critical (CVSS 9.8): Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key…
CVE-2020-12034 — High (CVSS 8.2): Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx…
CVE-2026-9128 — High (CVSS 7.5): A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the…
CVE-2026-9108 — High (CVSS 7.5): A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths…
CVE-2020-12038 — Medium (CVSS 5.5): Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx…
CVE-2020-12025 — Low (CVSS 3.3): Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity…

All CVEs affecting Rockwellautomation Studio 5000 Logix Designer →

Other CWE-863 (Incorrect Authorization) vulnerabilities

CVE-2026-75745 — Critical (CVSS 10.0): Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in…
CVE-2026-75723 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…
CVE-2026-69555 — Critical (CVSS 10.0): Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-71398 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…
CVE-2026-27302 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…
CVE-2026-48449 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…

Browse all CWE-863 (Incorrect Authorization) vulnerabilities →