Privilege Escalation in Rockwell Automation Redundancy Module Configuration Tool

Source context: this article examines information published by the source on September 01, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

Two security issues, identified as CVE-2026-9633 and CVE-2026-9634, have been found in the Rockwell Automation Redundancy Module Configuration Tool. Both vulnerabilities stem from incorrect default permissions (CWE-276) regarding how certain binaries search for required DLLs within system path directories.

Specifically, the RM3ConfigTool.exe binary (CVE-2026-9633) and the RMConfigTool.exe binary (CVE-2026-9634) may search directories that are writable by standard, non-administrator users. A local attacker could place a malicious DLL in one of these writable directories. If an administrator then executes the tool, the malicious DLL is loaded into the elevated process, allowing the attacker to execute processes with Administrator or SYSTEM privileges.

Exposure and applicability

These vulnerabilities affect the software utility used for configuring redundancy modules; they do not reside in the redundancy hardware itself. The vulnerabilities are not exploitable remotely.

• CVE-2026-9633: Affects Redundancy Module Configuration Tool version 10.00.00.
• CVE-2026-9634: Affects Redundancy Module Configuration Tool versions >=9.00.00 and <=10.00.00.

Asset owners should identify if these tools are installed on engineering workstations or maintenance laptops used to manage industrial redundancy configurations.

Remediation priorities

Our analysis suggests the following priority levels for remediation based on the local nature of the attack vector:

1. Update Software: The primary remediation is to update the Redundancy Module Configuration Tool to version 10.01.00, which addresses these issues.
2. Apply Hardening: For environments where an immediate upgrade is not feasible, we recommend implementing Rockwell Automation’s security best practices to reduce the risk of local unauthorized access to workstations.
3. Restrict Local Access: Since this attack requires local access to the file system, limiting the number of users with local login rights to engineering workstations can reduce the likelihood of a malicious DLL being placed in a system path.

How to validate remediation

To verify that exposure has been reduced, administrators should:
* Verify Versioning: Confirm that the installed version of the Redundancy Module Configuration Tool is 10.01.00 or later.
* Audit Permissions: Review the permissions of directories within the system path on workstations where the tool is deployed to ensure they are not writable by non-privileged users.

Note that a version check alone does not guarantee total system security, as it only addresses these specific DLL hijacking vulnerabilities.

Limits and open questions

It remains unknown if any third-party tools or custom scripts interact with these binaries in a way that could inadvertently facilitate the placement of files in writable directories. Additionally, while no public exploitation has been reported to CISA, the potential for local privilege escalation highlights the importance of securing the engineering workstations that manage critical OT infrastructure.

Source and editorial note

Rockwell Automation Redundancy Module Configuration Tool · Source date: September 01, 2026 · Retrieved September 01, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request an OT security assessment