DLL hijack flaws in Rockwell Redundancy Tool

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Two DLL search-order hijacking flaws in Rockwell Automation's Redundancy Module Configuration Tool allow local privilege escalation to Administrator/SYSTEM.

Sourcecisa.gov — open the original

CISA published an advisory for two vulnerabilities in Rockwell Automation's Redundancy Module Configuration Tool, used in critical manufacturing environments. Both CVE-2026-9633 (affecting version 10.00.00) and CVE-2026-9634 (affecting versions 9.00.00 through 10.00.00) stem from incorrect default directory permissions (CWE-276) that allow standard, non-administrator users to write malicious DLLs into directories searched by RM3ConfigTool.exe and RMConfigTool.exe respectively. If an administrator subsequently runs the vulnerable tool, the planted DLL loads into the elevated process and executes with Administrator/SYSTEM privileges.

Exploitation requires local access and is not remotely exploitable, and CISA states no known public exploitation has been reported. Rockwell Automation has released version 10.01.00 to remediate both issues; customers unable to upgrade are directed to Rockwell's security best-practices guidance. CISA also reiterates standard ICS hardening advice: minimizing network exposure, isolating control system networks behind firewalls, and using secure remote access methods such as VPNs.

Given the local-only attack vector, lack of known exploitation, and availability of a vendor fix, this represents a routine but relevant patch advisory for critical manufacturing operators using this configuration tool. Defenders should prioritize patching to 10.01.00 and review file/directory permissions on hosts running the affected utilities.

title: Rockwell Redundancy Tool Loading DLL from Writable Directory
description: Detects RM3ConfigTool.exe or RMConfigTool.exe loading a DLL from a directory
  where standard users have write access. DLL hijack exploitation requires the vulnerable
  tool to load an attacker-planted DLL; this rule identifies the loading behaviour
  from known-weak directory paths.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \RM3ConfigTool.exe
    - \RMConfigTool.exe
  selection_load_path:
    ImageLoaded|contains:
    - \\Temp\\
    - \\AppData\\Local\\Temp\\
    - \\AppData\\Roaming\\
    - \\ProgramData\\
  condition: selection_process and selection_load_path
falsepositives:
- Legitimate Rockwell plugins or add-ins installed to user AppData directories
- Administrative scripts legitimately placing DLLs in shared writable locations for
  tool use
level: medium
id: ad2ea5b6-b0e7-5c4f-ae0b-09c26ca43a91
status: experimental
author: Vorant

title: Low-Privilege Process Writing to Rockwell Redundancy Tool Directory
description: Detects a standard-privilege process writing DLLs or executables to Rockwell
  Redundancy Tool directories (RM3ConfigTool, RMConfigTool program paths). Successful
  DLL hijack exploitation requires planting a malicious DLL in a directory the vulnerable
  tool will search; this rule identifies the file-write staging behaviour.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - RM3ConfigTool
    - RMConfigTool
    TargetFilename|endswith:
    - .dll
    - .exe
  filter_system_admin:
    User|contains:
    - SYSTEM
    - NT AUTHORITY
    - -Administrators
  condition: selection and not filter_system_admin
falsepositives:
- Rockwell Automation installer or patch deployment running under a service account
  with elevated rights
- Developer workstations with shared write access to Rockwell tool directories
level: medium
id: 26c2d9d7-df36-5d19-9b7a-355bcfce3804
status: experimental
author: Vorant

title: Elevated Rockwell Redundancy Tool Spawned by Non-Admin User Session
description: Detects RM3ConfigTool.exe or RMConfigTool.exe running with elevated (Administrator/SYSTEM)
  privileges but initiated from a standard user login session. DLL hijack exploitation
  gains elevation when the admin-launched tool loads the attacker's planted DLL; this
  rule flags the elevation anomaly if process provenance can be correlated.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1574.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \RM3ConfigTool.exe
    - \RMConfigTool.exe
    IntegrityLevel:
    - High
    - System
  filter_admin_session:
    User|contains:
    - SYSTEM
    - NT AUTHORITY
    - -Administrators
  condition: selection and not filter_admin_session
falsepositives:
- Task Scheduler or service running the tool with elevated privileges under admin
  context
- Legitimate administrative RDP sessions launching the tool
level: low
id: 4b963217-77d7-53e5-97c6-85705e13d6ff
status: experimental
author: Vorant

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-02

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.