CVE-2026-9633
Received Received - Intake

DLL Search Order Hijacking in RM3ConfigTool

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Rockwell Automation

Description
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. If a local attacker places a malicious DLL in such a directory and an administrator subsequently runs the tool, the malicious DLL is loaded into the elevated process and executes with Administrator/SYSTEM privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-9633
EUVD
EUVD-2026-69147

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
rockwell_automation redundancy_module_configuration_tool *
rockwell_automation redunancy_module_configuration_tool to 10.01.00 (exc)
rockwell_automation redunancy_module_configuration_tool 10.01.00

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-276 During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-9633 is a high-severity vulnerability in Rockwell Automation's Redundancy Module Configuration Tool. The tool improperly searches system directories for a required DLL. Due to incorrect default permissions, standard users can write files to these directories. An attacker could place a malicious DLL there, which would load when an administrator runs the tool, executing with elevated privileges.

Impact Analysis

If exploited, this vulnerability allows an attacker to gain Administrator or SYSTEM privileges on a system running the vulnerable tool. This could lead to full system compromise, unauthorized data access, or installation of additional malware. Attackers need local access to place the malicious DLL.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and audit logging, such as GDPR's data protection principles or HIPAA's security rules. Unauthorized privilege escalation risks data breaches, potentially leading to regulatory penalties.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9633. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart