VORANT. Threat Intelligence Sign in Get the full feed

DLL hijack flaws in Rockwell Redundancy Tool

routine vulnerability manufacturing

Two DLL search-order hijacking flaws in Rockwell Automation's Redundancy Module Configuration Tool allow local privilege escalation to Administrator/SYSTEM.

CISA published an advisory for two vulnerabilities in Rockwell Automation's Redundancy Module Configuration Tool, used in critical manufacturing environments. Both CVE-2026-9633 (affecting version 10.00.00) and CVE-2026-9634 (affecting versions 9.00.00 through 10.00.00) stem from incorrect default directory permissions (CWE-276) that allow standard, non-administrator users to write malicious DLLs into directories searched by RM3ConfigTool.exe and RMConfigTool.exe respectively. If an administrator subsequently runs the vulnerable tool, the planted DLL loads into the elevated process and executes with Administrator/SYSTEM privileges.

Exploitation requires local access and is not remotely exploitable, and CISA states no known public exploitation has been reported. Rockwell Automation has released version 10.01.00 to remediate both issues; customers unable to upgrade are directed to Rockwell's security best-practices guidance. CISA also reiterates standard ICS hardening advice: minimizing network exposure, isolating control system networks behind firewalls, and using secure remote access methods such as VPNs.

Given the local-only attack vector, lack of known exploitation, and availability of a vendor fix, this represents a routine but relevant patch advisory for critical manufacturing operators using this configuration tool. Defenders should prioritize patching to 10.01.00 and review file/directory permissions on hosts running the affected utilities.

Mentioned in this report

Vulnerabilities CVE-2026-9633CVE-2026-9634

Detection guidance

Rockwell Redundancy Tool Loading DLL from Writable Directory

ATT&CK T1574.001

Detects RM3ConfigTool.exe or RMConfigTool.exe loading DLLs from directories with excessive write permissions, indicative of DLL hijack exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Rockwell Redundancy Tool Loading DLL from Writable Directory
description: Detects RM3ConfigTool.exe or RMConfigTool.exe loading a DLL from a directory
  where standard users have write access. DLL hijack exploitation requires the vulnerable
  tool to load an attacker-planted DLL; this rule identifies the loading behaviour
  from known-weak directory paths.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \RM3ConfigTool.exe
    - \RMConfigTool.exe
  selection_load_path:
    ImageLoaded|contains:
    - \\Temp\\
    - \\AppData\\Local\\Temp\\
    - \\AppData\\Roaming\\
    - \\ProgramData\\
  condition: selection_process and selection_load_path
falsepositives:
- Legitimate Rockwell plugins or add-ins installed to user AppData directories
- Administrative scripts legitimately placing DLLs in shared writable locations for
  tool use
level: medium
id: ad2ea5b6-b0e7-5c4f-ae0b-09c26ca43a91
status: experimental
author: Vorant

Low-Privilege Process Writing to Rockwell Redundancy Tool Directory

ATT&CK T1574.001

Detects a non-administrator process writing executable files (.dll, .exe) to the Rockwell Redundancy Tool installation or configuration directory, a prerequisite for DLL hijack exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Low-Privilege Process Writing to Rockwell Redundancy Tool Directory
description: Detects a standard-privilege process writing DLLs or executables to Rockwell
  Redundancy Tool directories (RM3ConfigTool, RMConfigTool program paths). Successful
  DLL hijack exploitation requires planting a malicious DLL in a directory the vulnerable
  tool will search; this rule identifies the file-write staging behaviour.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - RM3ConfigTool
    - RMConfigTool
    TargetFilename|endswith:
    - .dll
    - .exe
  filter_system_admin:
    User|contains:
    - SYSTEM
    - NT AUTHORITY
    - -Administrators
  condition: selection and not filter_system_admin
falsepositives:
- Rockwell Automation installer or patch deployment running under a service account
  with elevated rights
- Developer workstations with shared write access to Rockwell tool directories
level: medium
id: 26c2d9d7-df36-5d19-9b7a-355bcfce3804
status: experimental
author: Vorant

Elevated Rockwell Redundancy Tool Spawned by Non-Admin User Session

ATT&CK T1574.001

Detects RM3ConfigTool.exe or RMConfigTool.exe running with elevated privileges but launched from a non-administrator user context, a sign of privilege escalation via hijacked DLL. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Elevated Rockwell Redundancy Tool Spawned by Non-Admin User Session
description: Detects RM3ConfigTool.exe or RMConfigTool.exe running with elevated (Administrator/SYSTEM)
  privileges but initiated from a standard user login session. DLL hijack exploitation
  gains elevation when the admin-launched tool loads the attacker's planted DLL; this
  rule flags the elevation anomaly if process provenance can be correlated.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1574.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \RM3ConfigTool.exe
    - \RMConfigTool.exe
    IntegrityLevel:
    - High
    - System
  filter_admin_session:
    User|contains:
    - SYSTEM
    - NT AUTHORITY
    - -Administrators
  condition: selection and not filter_admin_session
falsepositives:
- Task Scheduler or service running the tool with elevated privileges under admin
  context
- Legitimate administrative RDP sessions launching the tool
level: low
id: 4b963217-77d7-53e5-97c6-85705e13d6ff
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-02

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free