Critical Vulnerability (CVE‑2026‑12663) in Rockwell Automation ControlFLASH Allows Arbitrary Code Execution
What It Is — A missing authentication issue in the ControlFLASH installer grants the “Everyone” group write permissions on the product’s installation directory, enabling an attacker to place and run arbitrary code at the logged‑in user’s privilege level.
Exploitability — CVSS v3.1 base score 7.3 (High). No public exploit is known, but the flaw is trivial to weaponise once an attacker can write to the directory.
Affected Products — Rockwell Automation ControlFLASH versions ≤ V15.07.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous verification that privileged file‑system permissions follow the least‑privilege control objective, a cornerstone of audit‑ready security programs.
- The vendor‑issued fix (version 15.08) provides concrete remediation evidence; tracking patch status is essential for demonstrating control effectiveness to auditors and partners.
- Mis‑configured installer permissions expose OT environments to command execution, a red flag for supply‑chain and vendor‑risk assessments that rely on demonstrable control hygiene.
Recommended Actions
- Upgrade all ControlFLASH installations to version 15.08 or later.
- Audit the installation directory and remove “Everyone” write access.
- Embed permission‑validation checks into your continuous control‑monitoring pipeline.
- Record remediation steps in your change‑management system to supply defensible evidence for audits.
Source: CISA Advisory – ICSA‑26‑246‑03