Rockwell Automation DLL Hijacking Flaws Enable Local Privilege Escalation in ICS Environments

As reported by CISA in advisory ICSA-26-244-02, Rockwell Automation has disclosed two local privilege escalation vulnerabilities in its Redundancy Module Configuration Tool — CVE-2026-9633 and CVE-2026-9634. Both stem from incorrect default permissions (CWE-276) that allow a non-administrator to plant a malicious DLL in a searchable directory, which is then loaded with elevated privileges when an administrator runs the tool. The CVSS v3 base score is 7.3 (High).

Vulnerability Details

CVE	Affected Versions	CVSS	Severity	Patch Available	Active Exploitation
CVE-2026-9633	10.00.00	7.3	High	Yes — v10.01.00	Not reported
CVE-2026-9634	>=9.00.00 and <=10.00.00	7.3	High	Yes — v10.01.00	Not reported

Why This Matters

DLL search order hijacking is not a new technique, but its impact in OT environments is disproportionately severe. In a typical IT scenario, local privilege escalation gets an attacker from a standard user to SYSTEM on a single workstation. In an ICS context, that same escalation on an engineering workstation running Rockwell configuration tools can be the pivot point between initial access and operational disruption. If an attacker has already gained a foothold through phishing, supply-chain compromise, or another lower-privilege vector, this flaw provides the elevation needed to modify controller configurations, alter redundancy module behavior, or establish persistence on the HMI/engineering layer.

The affected tool is deployed worldwide across critical manufacturing environments — environments where uptime is measured in minutes and a misconfigured redundancy module can mean the difference between graceful failover and a costly plant outage. The advisory notes the tool affects RM3 (Redundancy Module 3) configurations, meaning organizations relying on high-availability controller setups are in scope.

Who Is at Risk

Critical Manufacturing — the primary sector identified by CISA, particularly facilities using Rockwell redundancy modules for fault-tolerant PLC configurations.
Engineering Workstations — any Windows host running RM3ConfigTool.exe v9.00.00 through v10.00.00 where multiple users share interactive sessions or where an attacker has already gained low-privilege access.
Shared/Multi-User Terminals — shop-floor terminals where operators and engineers share login sessions are especially exposed, since standard users can plant DLLs in writable path directories.

The key concern is not the vulnerability in isolation — it is how this flaw chains with other access vectors. An attacker who obtains any standard-user foothold on an engineering workstation can use this to escalate, then leverage the elevated RM3 tool session to push malicious configurations to controllers.

Broader Implications

This advisory underscores a persistent problem in ICS software: legacy installation practices that leave writable directories in the system PATH. Vendors must adopt secure-by-default installation routines that restrict ACLs on application directories, but until then, asset owners carry the burden of verification. The fact that two separate CVEs were assigned for what is essentially the same class of issue across adjacent versions suggests the problem was systemic in the build pipeline, not a one-off oversight.

Shield53 Recommendations

Immediate Actions

Shield53 Recommendations

Patch now: Upgrade to Redundancy Module Configuration Tool v10.01.00 on all engineering and HMI workstations. This is the definitive fix from Rockwell Automation.

Restrict tool execution: If patching is delayed, ensure RM3ConfigTool.exe is only executed by dedicated service accounts with minimal interactive login exposure. Do not run it from shared or kiosk sessions.

Audit PATH directories: Enumerate all directories in the system PATH on workstations running the tool. Remove write permissions for standard users and Authenticated Users on any directory the tool searches. Use icacls or PowerShell ACL review scripts to verify.

Deploy application whitelisting: Use Windows Defender Application Control (WDAC) or AppLocker to restrict DLL loading for RM3ConfigTool.exe to signed, trusted paths only.

Monitor for exploitation: Enable Sysmon Event ID 7 (Image Loaded) filtered on RM3ConfigTool.exe and alert on DLLs loaded from non-standard or user-writable directories. Also monitor for unexpected process creation of RM3ConfigTool.exe by non-engineering accounts.

Network segmentation: Ensure engineering workstations are not reachable from general corporate user subnets. This limits the ability of an attacker with initial access elsewhere to reach and exploit the configuration tool host.

Follow Rockwell hardening guidance: Apply the security best practices documented in Rockwell's support advisory (answer ID 1085012) for defense-in-depth on automation assets.

Detection Rule (Sysmon)

Deploy a Sysmon rule targeting suspicious DLL loads by the configuration tool:

<RuleGroup name="RM3 DLL Hijack Detection" groupRelation="and"> <ImageLoad condition="contains">RM3ConfigTool.exe</ImageLoad> <ImageLoaded condition="contains">\Users\</ImageLoaded> </RuleGroup>

Alert on any DLL loaded from user-writable directories when RM3ConfigTool.exe is the requesting process. This is a strong indicator of exploitation or pre-positioning of a malicious payload.

Asset owners should treat this advisory as a reminder to audit all Rockwell Automation tools — not just this one — for similar DLL search path weaknesses. The systemic nature of the flaw across versions suggests other configuration utilities in the Rockwell ecosystem may share the same exposure pattern.