CVE-2026-12663: Rockwell Automation Controlflash

High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days.

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level.

Affected products

• Rockwell Automation Controlflash: up to and including V15.07

Published 2026-09-01. Last modified 2026-09-01.