Rockwell ControlFLASH flaw allows privilege escalation
Weak installer permissions in Rockwell Automation ControlFLASH <=V15.07 could let a local attacker execute arbitrary code as the logged-in user.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory detailing a local privilege/code-execution issue in Rockwell Automation's ControlFLASH firmware-update utility, used across critical manufacturing, energy, and water/wastewater sectors worldwide. The vulnerability (CVE-2026-12663) stems from the installer granting the 'Everyone' group write permissions to the product's installation directory, which could allow a local, low-privileged user or malicious process to plant or modify files and achieve arbitrary code execution at the logged-in user's permission level.
The flaw is not remotely exploitable and requires local access to the host running ControlFLASH. Rockwell has fixed the issue in version 15.08 and recommends all users upgrade. For those unable to patch, Rockwell and CISA provide a manual mitigation to remove the 'Everyone' group's write access from the affected installation directory. CISA states no known public exploitation of this vulnerability has been reported at this time.
Mentioned in this report
Detection guidance
Suspicious DLL/Executable Loaded from ControlFLASH Installation Directory by Unprivileged Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects image load of DLLs or executables from ControlFLASH installation directory by non-admin processes, indicating potential code execution via planted/modified binaries exploiting weak directory permissions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious DLL/Executable Loaded from ControlFLASH Installation Directory by
Unprivileged Process
description: Detects image load (DLL injection or process execution) from ControlFLASH
installation directory by non-SYSTEM, non-admin processes. Indicates potential exploitation
of weak permissions allowing a low-privileged user to plant malicious DLLs or executables.
tags:
- attack.privilege-escalation
- attack.lateral-movement
- attack.t1574.005
logsource:
category: image_load
product: windows
detection:
selection_load:
ImageLoaded|contains:
- \Rockwell Automation\ControlFLASH\
- \Program Files\Rockwell Automation\ControlFLASH\
ImageLoaded|endswith:
- .dll
- .exe
filter_admin:
User|contains:
- SYSTEM
- Administrators
condition: selection_load and not filter_admin
falsepositives:
- Legitimate ControlFLASH plug-in loading by authorized users
- Vendor-signed monitoring or utility tools executing from the installation directory
level: high
id: db874f0b-eb48-510c-bdda-58ee00ce1d6b
status: experimental
author: Vorant
Process Execution from Modified ControlFLASH Installation Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects execution of processes originating from ControlFLASH installation directory by low-privileged users, suggesting malicious executable placement via weak directory permissions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Execution from Modified ControlFLASH Installation Directory
description: Detects process creation with executable path in ControlFLASH installation
directory by non-admin users. Indicates potential execution of a maliciously planted
or modified executable exploiting CVE-2026-12663 weak directory permissions.
tags:
- attack.privilege-escalation
- attack.execution
- attack.t1574.005
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains:
- \Rockwell Automation\ControlFLASH\
- \Program Files\Rockwell Automation\ControlFLASH\
filter_admin:
User|contains:
- SYSTEM
- Administrators
filter_known_exe:
Image|endswith:
- \ControlFLASH.exe
- \ControlFLASHEng.exe
condition: selection and not filter_admin and not filter_known_exe
falsepositives:
- Legitimate vendor-bundled tools or utilities within the ControlFLASH directory executed
by standard users during authorized administration
level: medium
id: 310dc35b-af9b-55f3-adbf-b603007339d4
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-03
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs