Vulnerabilities
Rockwell Automation Redundancy Module Config Tool: Local DLL Injection Enables Privilege Escalation
The Redundancy Module Configuration Tool (RM3ConfigTool.exe) can load DLLs from directories that may be writable by standard users. A local attacker can drop a malicious DLL into such a folder; when an administrator runs the tool, the DLL runs with SYSTEM privileges. CVE‑2026‑9633 and CVE‑2026‑9634 affect versions 9.00.00 through 10.00.00 and carry a CVSS score of 7.3. Rockwell Automation has issued a patch in version 10.01.00. Until the update is applied, users should follow the vendor’s security best‑practice guidance.
Rockwell Automation’s Redundancy Module Configuration Tool (RM3ConfigTool.exe) has a critical flaw that allows local privilege escalation. The tool searches the system path for a required DLL, and some of those directories can be written to by non‑administrator users due to incorrect default permissions. An attacker can place a malicious DLL in one of these writable directories. When an administrator launches the tool, the DLL is loaded into the elevated process, giving the attacker SYSTEM‑level execution.
Vulnerabilities
- CVE‑2026‑9633 – Incorrect default permissions on search directories.
- CVE‑2026‑9634 – Same issue affecting earlier releases.
Affected Versions
- Redundancy Module Configuration Tool 10.00.00
- Redundancy Module Configuration Tool versions 9.00.00 through 10.00.00
Risk Assessment
CVSS 3.1 score: 7.3 (High). Local attacker with low privileges can gain full administrative rights on the host.
Mitigation
- Upgrade to version 10.01.00 or later.
- If upgrade is not immediately possible, implement the vendor’s recommended security best practices to restrict write access to the DLL search directories.
Rockwell Automation has released a patch in version 10.01.00 to address this issue. Users are urged to apply the update as soon as possible.
Related vulnerabilities
Inductive Automation Ignition Privilege Escalation Vulnerability (CVE‑2026‑92817)
Inductive Automation’s Ignition platform (8.1.0‑8.1.54 and 8.3.0‑8.3.8) suffers a privilege‑escalation flaw that lets an authenticated Vision user gain Designer rights and execute arbitrary code. The CVSS v3 score is 8.8. Immediate patching to 8.1.55 or 8.3.9 is required.
Read briefing
CVE-2026-70104: Windows Win32k Privilege Escalation Vulnerability
A local privilege escalation flaw in the Windows Win32 kernel subsystem allows an authenticated user to gain elevated rights by dereferencing an untrusted pointer. Microsoft has issued a patch; defenders should update systems immediately and verify that the kernel component is patched.
Read briefing
Windows License Manager Privilege Escalation Vulnerability (CVE‑2026‑62777)
Microsoft has disclosed a local privilege‑escalation flaw in the Windows License Manager component. The vulnerability could allow an attacker with local access to gain SYSTEM rights. Defenders should monitor for suspicious activity and apply the forthcoming update when available.
Read briefing
NoMachine Redis Authentication Flaw Enables Local Privilege Escalation (CVE-2026-92209)
A flaw in NoMachine’s Redis authentication allows local attackers to elevate privileges after gaining low‑privileged code execution. The issue stems from weak credential generation and affects versions prior to v10.1.7, v9.9.6, and v8.27.1. Defenders should patch immediately and monitor for local privilege escalation attempts.
Read briefing