CVE-2026-12663: CWE-306 Missing authentication for critical function in Rockwell Automation ControlFLASH ®

This vulnerability arises from ControlFLASH® installer granting write permissions to the "Everyone" group on the product installation directory. This misconfiguration can lead to arbitrary code execution by enabling an attacker to place or modify files in the installation directory and execute code with the permissions of the logged-in user. The CVSS 4.0 score of 7 reflects a high severity with local attack vector, low attack complexity, no attack traceability, and partial user interaction required. No remediation or patch information is currently available.

If exploited, an attacker with local access could execute arbitrary code on the affected system with the privileges of the logged-in user. This could lead to unauthorized command execution and potential compromise of the system at the user level. There is no indication of remote exploitation or elevation of privilege beyond the logged-in user's rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and consider applying file system permissions manually to limit write access to the installation directory.