# Rockwell ControlFLASH flaw allows privilege escalation

Published: 2026-09-03 · Severity: routine · Sectors: manufacturing, energy, infrastructure
Canonical: https://vorant.io/reports/e161a7f4-e558-5e51-82e8-194f4fd08ebe/rockwell-controlflash-flaw-allows-privilege-escalation

> Weak installer permissions in Rockwell Automation ControlFLASH <=V15.07 could let a local attacker execute arbitrary code as the logged-in user.

CISA published an ICS advisory detailing a local privilege/code-execution issue in Rockwell Automation's ControlFLASH firmware-update utility, used across critical manufacturing, energy, and water/wastewater sectors worldwide. The vulnerability (CVE-2026-12663) stems from the installer granting the 'Everyone' group write permissions to the product's installation directory, which could allow a local, low-privileged user or malicious process to plant or modify files and achieve arbitrary code execution at the logged-in user's permission level.

The flaw is not remotely exploitable and requires local access to the host running ControlFLASH. Rockwell has fixed the issue in version 15.08 and recommends all users upgrade. For those unable to patch, Rockwell and CISA provide a manual mitigation to remove the 'Everyone' group's write access from the affected installation directory. CISA states no known public exploitation of this vulnerability has been reported at this time.

## Mentioned in this report

- Vulnerabilities: CVE-2026-12663

## Detection guidance (public sample)

### Suspicious DLL/Executable Loaded from ControlFLASH Installation Directory by Unprivileged Process

ATT&CK: T1574.005

Detects image load of DLLs or executables from ControlFLASH installation directory by non-admin processes, indicating potential code execution via planted/modified binaries exploiting weak directory permissions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious DLL/Executable Loaded from ControlFLASH Installation Directory by
  Unprivileged Process
description: Detects image load (DLL injection or process execution) from ControlFLASH
  installation directory by non-SYSTEM, non-admin processes. Indicates potential exploitation
  of weak permissions allowing a low-privileged user to plant malicious DLLs or executables.
tags:
- attack.privilege-escalation
- attack.lateral-movement
- attack.t1574.005
logsource:
  category: image_load
  product: windows
detection:
  selection_load:
    ImageLoaded|contains:
    - \Rockwell Automation\ControlFLASH\
    - \Program Files\Rockwell Automation\ControlFLASH\
    ImageLoaded|endswith:
    - .dll
    - .exe
  filter_admin:
    User|contains:
    - SYSTEM
    - Administrators
  condition: selection_load and not filter_admin
falsepositives:
- Legitimate ControlFLASH plug-in loading by authorized users
- Vendor-signed monitoring or utility tools executing from the installation directory
level: high
id: db874f0b-eb48-510c-bdda-58ee00ce1d6b
status: experimental
author: Vorant
```

### Process Execution from Modified ControlFLASH Installation Directory

ATT&CK: T1574.005

Detects execution of processes originating from ControlFLASH installation directory by low-privileged users, suggesting malicious executable placement via weak directory permissions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Process Execution from Modified ControlFLASH Installation Directory
description: Detects process creation with executable path in ControlFLASH installation
  directory by non-admin users. Indicates potential execution of a maliciously planted
  or modified executable exploiting CVE-2026-12663 weak directory permissions.
tags:
- attack.privilege-escalation
- attack.execution
- attack.t1574.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
    - \Rockwell Automation\ControlFLASH\
    - \Program Files\Rockwell Automation\ControlFLASH\
  filter_admin:
    User|contains:
    - SYSTEM
    - Administrators
  filter_known_exe:
    Image|endswith:
    - \ControlFLASH.exe
    - \ControlFLASHEng.exe
  condition: selection and not filter_admin and not filter_known_exe
falsepositives:
- Legitimate vendor-bundled tools or utilities within the ControlFLASH directory executed
  by standard users during authorized administration
level: medium
id: 310dc35b-af9b-55f3-adbf-b603007339d4
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e161a7f4-e558-5e51-82e8-194f4fd08ebe/rockwell-controlflash-flaw-allows-privilege-escalation.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup