CVE-2026-9128: A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the

unknownCVE-2026-9128

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-07-14
Last updated: 2026-07-14
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-9128

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-91280.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-9128	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalRockwell Automation Studio 5000 Logix Designercisa
medium[NEW] [medium] Rockwell Automation Studio 5000 Logix Designer: Multiple vulnerabilities allow code executioncert-bund

Recent advisories for A code execution

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-16144: The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Re…nvd · 2026-08-01
highCVE-2026-34641: Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrar…nvd · 2026-07-31
criticalCVE-2026-68771: ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset no…nvd · 2026-07-31
criticalCVE-2026-68770: sentence-transformers contains a security control bypass vulnerability that allows attackers t…nvd · 2026-07-31
unknownCVE-2026-51785: An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitr…nvd · 2026-07-31
unknownCVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Pluginaws · 2026-07-31