noindex and left out of the sitemap until more data is confirmed.CVE-2026-12663 is a missing-authentication flaw in Rockwell Automation's ControlFLASH firmware-flashing utility: its installer grants the Windows "Everyone" group write access to the product's installation directory, letting a local user run arbitrary code at the logged-in user's privilege level; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.1%
EPSS score (FIRST)
No
CISA KEV catalog
2026-09-01
Published
Vulnerability ID: CVE-2026-12663 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Rockwell Automation ControlFLASH | — | V15.07 and prior (per CISA Advisory ICSA-26-246-03); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-12663 is a missing authentication for critical function weakness (CWE-306) in Rockwell Automation ControlFLASH, the utility engineers use to flash firmware onto Allen-Bradley/Rockwell PLCs and other ICS devices. CISA's advisory states the installer "grants the Everyone group write permissions to a product-installation directory," which "could give an attacker the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level" (CISA ICS Advisory ICSA-26-246-03).
NVD tracks CVE-2026-12663 with status "Awaiting Analysis" as of 2026-10-22: it has recorded Rockwell's own CNA-submitted CVSS v4.0 score of 7.0 (vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), but has not published its own independent score or CPE applicability statement, so this page leaves cvss_score unset rather than presenting Rockwell's figure as NVD-confirmed. CISA's own advisory additionally lists a CVSS v3.1 score of 7.3 (vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) for the same issue (NVD; CISA ICS Advisory ICSA-26-246-03).
CISA's advisory, released 2026-09-03, states the vulnerability requires an attacker to have physical access via keyboard and display during installation and "is not exploitable remotely." Rockwell fixed the issue in ControlFLASH 15.08; the documented workaround for devices that cannot be immediately updated is to remove the "Everyone" group's permissions from the ControlFLASH installation directory (CISA ICS Advisory ICSA-26-246-03).
CISA's advisory reports no known public exploitation of this CVE as of its release. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.0012 (1.6th percentile) — very low, consistent with a flaw that needs local, in-person access during installation rather than being remotely exploitable (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, ControlFLASH users should update to version 15.08 or remove "Everyone" group write access from the installation directory on any workstation where immediate patching is not possible.
Evidence
- ControlFLASH installer grants the "Everyone" group write permission on its installation directory, enabling local arbitrary code execution at the logged-in user's privilege level (CWE-306). — CISA ICS Advisory ICSA-26-246-03
- NVD status is "Awaiting Analysis" with Rockwell-submitted CVSS v4.0 7.0; CISA's advisory separately lists CVSS v3.1 7.3; no NVD-published score or CPE configuration as of 2026-10-22. — NVD
- Affects ControlFLASH V15.07 and prior; requires physical access during installation, not exploitable remotely; fixed in 15.08, workaround is removing "Everyone" permissions on the install directory. — CISA ICS Advisory ICSA-26-246-03
- Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
- EPSS score is 0.0012 (1.6th percentile) as of 2026-10-22. — FIRST EPSS
