Quick answers
- Is CVE-2026-12663 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12663 being exploited in the wild.
- How severe is CVE-2026-12663?
- Informational severity, with a CVSS score of 7.3, published 1 September 2026.
- Which products and versions are affected?
- Rockwell Automation ControlFLASH 15.07 and prior.
- Is there a fix for CVE-2026-12663?
- A patch was published on 2026-09-01: Fix available in version 15.08 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12663 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-12663?
- Check whether you run Rockwell Automation ControlFLASH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper access control issue (CWE-306) in the ControlFLASH installer. During installation, the utility grants write permissions to the "Everyone" group on the installation directory (C:\Program Files (x86)\ControlFLASH\0001), enabling local privilege escalation or code injection. An attacker with local file system access can replace legitimate executables or DLLs in the installation folder with malicious ones. Exploitation requires local access to the system and affects users running at the privilege level of the logged-in account. The vulnerability was found internally during routine testing. A fix is available in ControlFLASH version 15.08 and later; affected users on v15.07 and prior can manually remediate by removing the Everyone group's permissions on the installation directory.
Affected products
- Rockwell Automation ControlFLASH 15.07 and prior
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fix available in version 15.08