Rockwell RMConfigTool DLL Hijack RCE (CVE-2026-9633/9634)

Rockwell Automation Redundant Module Configuration Tool - Multiple Vulnerabilities Vulnerability Overview Severity: High Advisory Number: SA1080 Release Date: September 1, 2026 Last Updated: September 1, 2026 Revision: 1.0 Known to be Exploited: No Fixed: No Interim Mitigations: None Scope of Impact Vulnerability Details CVE-2026-9633 - Impact: The R Module Configuration Tool binary in the Redundant Module Configuration Tool searches directories in system paths for required DLLs. If one of these directories is writable by a standard (non-administrative) user, an attacker can place a malicious DLL, which will be loaded into the elevated process when an administrator runs the tool and executed with administrator/SYSTEM privileges. - CVSS 3.1 Base Score: 7.3/10 - CVSS 4.0 Base Score: 7.0/10 - CWE: CWE-276: Incorrect Default Permissions - Known to be Exploited: No CVE-2026-9634 - Impact: The RMConfigTool.exe binary in the Redundant Module Configuration Tool searches directories in system paths for required DLLs. If one of these directories is writable by a standard (non-administrative) user, an attacker can place a malicious DLL, which will be loaded into the elevated process when an administrator runs the tool and executed with administrator/SYSTEM privileges. - CVSS 3.1 Base Score: 7.3/10 - CVSS 4.0 Base Score: 7.0/10 - CWE: CWE-276: Incorrect Default Permissions - Known to be Exploited: No Remediation Mitigations and Interim Measures: Customers using the affected software who cannot upgrade to the fixed version should refer to Rockwell Automation’s best security practices. Fixed Version: 10.01.00 Revision History: Version 1.0, September 1, 2026, initial release. Glossary Arbitrary Code Execution: The ability of an attacker to execute arbitrary commands or code on a target machine or in a target process. DLL (Dynamic Link Library): A file container holding reusable code and data that enables sharing functionality across Windows applications, reducing data duplication and simplifying software design. Obtaining the Latest Product Security Information Visit the Trust Center page for Rockwell Automation security advisories: - Subscribe to product security alerts - View the latest list of Rockwell Automation security advisories - Report potential security issues in Rockwell Automation products - Learn more about the vulnerability policy Support For any questions, please contact TechConnect for assistance. For any questions, please contact PSIRT. Email: asecure@ra.rockwell.com Legal Disclaimer Rockwell Automation does not guarantee the completeness, timeliness, or accuracy of the data contained on this website and reserves the right to make changes at any time.

Goal Reached Thanks to every supporter — we hit 100%!

Rockwell RMConfigTool DLL Hijack RCE (CVE-2026-9633/9634)

More from this source