ControlFLASH installer grants Everyone write access to directory
The vulnerable permission is removed by patch v15.08, but until then any user on the engineering workstation can drop code into the installation path.
TL;DR
CISA republished a Rockwell Automation advisory for ControlFLASH ≤v15.07: the installer grants the "Everyone" group write permissions on the product installation directory, enabling arbitrary code execution at the logged-in user's privilege level. Version 15.08 removes the permission. Organizations that can't patch immediately can strip the Everyone group from the folder manually. Critical manufacturing, energy, and water systems are the affected sectors. No known public exploitation, and the vulnerability is local, not remotely exploitable.
Rockwell Automation's ControlFLASH firmware-flashing tool (widely used across critical manufacturing, energy, and water/wastewater environments) ships an installer that's been handing write permissions to the "Everyone" group on the application directory. CISA republished the vendor's advisory Wednesday under ICSA-26-246-03.
The fix is v15.08, and the workaround is straightforward: right-click the folder, properties, security tab, remove Everyone. But the vulnerability is local, not remote, which means the real risk is someone already on the engineering workstation (or malware that landed there) dropping arbitrary code into a path that doesn't normally see changes between firmware flash cycles. CVE-2026-12663 carries a CVSS v3.1 base score of 7.3 (CVSS v4: 7.0).
This is the third Rockwell advisory CISA has republished in the first three days of September. Monday's FactoryTalk Activation Manager patch addressed a privilege escalation in a different tool. Tuesday's Logix Platform advisory covered a denial-of-service in ControlLogix, CompactLogix, and GuardLogix. The ControlFLASH issue is distinct: it's a misconfiguration in the installer, not a code flaw in the runtime.
For OT environments where the flashing tool runs on a shared engineering workstation (flat network, multiple shift engineers, one machine) the Everyone permission means any authenticated user who sits down at that console can write to the directory. Organizations that can't patch immediately should verify whether the installation path has been modified since deployment and remove the Everyone group per Rockwell's documented steps.
Published ·Deep Fathom