Rockwell Automation ControlFLASH
view advisory published 2026-09-03
Successful exploitation of this vulnerability could give an attacker the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-12663US | —OT elevated | — | ||
A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary c… | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-26-246-03 JSONself
- ICSA Advisory ICSA-26-246-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (1)
- MitigationControlFLASH
Rockwell Automation has corrected this issue in software version 15.08, and encourages all users to update to the newest version.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan