CVE-2026-12663
Received Received - Intake

ControlFLASH™ Improper Permissions Leading to Arbitrary Code Execution

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Rockwell Automation

Description
A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-12663
EUVD
EUVD-2026-69136

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
rockwell_automation controlflash *
rockwell_automation controlflash to 15.08 (exc)
rockwell_automation controlflash 15.08

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper access control issue in Rockwell Automation's ControlFLASH™ firmware management utility. The installer incorrectly grants write permissions to the 'Everyone' group on the installation directory, allowing arbitrary code execution at the logged-in user's permission level.

Detection Guidance

Check the permissions of the ControlFLASH installation directory using commands like 'icacls' on Windows or 'ls -ld' on Linux to verify if the 'Everyone' group has write permissions. Compare the directory permissions against the expected secure configuration.

Impact Analysis

An attacker could exploit this to run malicious commands or code on your machine at your user's permission level. This could lead to unauthorized system access, data theft, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR or HIPAA. Organizations must address it to maintain regulatory compliance and protect sensitive data.

Mitigation Strategies

Upgrade to ControlFLASH version 15.08 or later if available. If upgrading is not possible, manually remove write permissions for the 'Everyone' group from the installation directory using system tools like 'icacls' or file manager settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart