CVE-2026-9127
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A remote code execution vulnerability exists in Studio 5000 Logix Designer due to incorrect authorization on a configuration file. Any authenticated user can modify the paths of external tools configured within the application. An attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.
Risk Assessment
The risk for the organization includes potential system takeover by an attacker, leading to data theft, disruption of industrial processes, or further propagation of the attack within the network.
Recommendation
It is recommended to immediately apply security patches provided by the vendor and restrict user permissions to modify configuration files. Additionally, monitor changes to external tool configurations.
Other vulnerabilities in Studio 5000 Logix Designer
See all- CVE-2026-9128High
A code execution vulnerability exists in Studio 5000 Logix Designer due to an unquoted search path in the External Tools configuration. Executable paths containing spaces are not properly quoted, allowing an attacker to place a malicious executable earlier in the search order and achieve arbitrary code execution.
- CVE-2026-9108High
A path traversal vulnerability exists in Studio 5000 Logix Designer due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during project opening, allowing path traversal sequences. Exploitation could allow an attacker to write arbitrary files to attacker-controlled locations, potentially leading to code execution.
Original NVD description (English source)
A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.