Path Traversal in Rockwell Automation Studio 5000 Logix Designer
CVE-2026-9108
A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (7.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 7.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Rockwell Automation Studio 5000 Logix Designer — versions V36.00, 35.00,35.01, 34.00-34.03, 33.00-33.03, 32.00-32.04 and older
- Rockwellautomation Studio 5000 Logix Designer — versions 36.00
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-9108?
- CVE-2026-9108 is a high-severity vulnerability in Rockwell Automation Studio 5000 Logix Designer, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-07-14.
- How severe is CVE-2026-9108?
- High severity. CVSS v3 base score is 7.5 out of 10.