CVE-2026-9128: rockwell automation studio 5000 logix designer Unquoted Search Path or Element

Vulnerability summary

CVE-2026-9128 is a high (CVSS 7.5) Unquoted Search Path or Element vulnerability in rockwell automation studio 5000 logix designer. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.7% of scored vulnerabilities.

Timeline

1. 14-07-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.

• CWE-428Unquoted Search Path or ElementThe product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.