The Firmware Tool That Writes to Everyone
Rockwell's ControlFLASH installer granted write permissions to the Everyone group on its own program directory, letting any local user plant code that runs when an engineer flashes a controller.
CISA published ICSA-26-246-03 on 3 September, covering Rockwell Automation's ControlFLASH at version 15.07 and earlier. CVE-2026-12663 is classified CWE-306, missing authentication for a critical function, and scored 7.3 on CVSS v3.1 and 7.0 on v4.0. The defect is that the installer grants write permissions to the Everyone group on the product's installation directory, which means any local user can replace or add files there and have them executed at the logged-in user's privilege level. It is not remotely exploitable and requires local access. Rockwell fixed it in version 15.08; anyone unable to upgrade is told to remove the Everyone group from the permissions on C:\Program Files (x86)\ControlFLASH\0001 through the Security tab of the folder's properties. The listed sectors are critical manufacturing, energy, and water and wastewater.
The modest score understates this one, and the reason is what ControlFLASH does. It is the tool engineers use to flash firmware onto Logix controllers and networked modules. A local attacker who can write into its program directory is not attacking a utility application; they are positioned on the path by which trusted firmware reaches controllers. The escalation is not from user to administrator — it is from a foothold on an engineering workstation to code execution in the moment someone updates a PLC.
That makes the engineering workstation the asset worth reasoning about. In most plants it is the least controlled machine in the OT environment: it runs vendor tools that demand local administrator rights, it is exempted from the standard software inventory because the tools break under it, it is shared between integrators and staff, and it frequently carries USB media from wherever the last job was. A local-access-only vulnerability on such a machine is not a high bar.
The fix is quick and the follow-up is the valuable part. Update ControlFLASH to 15.08 and check the directory permissions directly rather than assuming the installer corrected them, because an in-place upgrade does not always reset an ACL a previous installer created. Then apply the same check to the rest of the vendor toolchain on that machine: installers that write to Program Files with loose permissions are a recurring class of defect in industrial engineering software, and a short audit of the directories those tools own frequently finds more than one. And if the engineering workstation is not currently covered by application allowlisting or a proper software inventory, this advisory is the argument for both.