The vulnerability CVE-2026-9108 in Studio 5000 Logix Designer is caused by improper limitation of file paths within ACD project files. Specifically, the software fails to sanitize or validate file names embedded in the ACD file structure during project opening, allowing path traversal sequences to escape the intended extraction directory. An attacker can exploit this by crafting a malicious ACD project file that writes arbitrary files to locations outside the intended directory, potentially leading to code execution. The CVSS 4.0 vector indicates local attack vector with high complexity, requiring partial user interaction and low privileges, with high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no patch or official fix has been published as of the data provided.

Successful exploitation allows an attacker to write arbitrary files to attacker-controlled locations on the file system via crafted ACD project files. This can lead to code execution under the context of the user opening the project file. The vulnerability impacts confidentiality, integrity, and availability of the affected system. However, exploitation requires local access with low privileges and user interaction, and the attack complexity is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening ACD project files from untrusted sources. No official mitigation or temporary fix has been provided by Rockwell Automation at this time.