CISA Advisories Two Rockwell Automation Redundancy Module Configuration Tool Vulnerabilities Allow Privilege Escalation

The Cybersecurity and Infrastructure Security Agency (CISA) has included two vulnerabilities affecting Rockwell Automation's Redundancy Module Configuration Tool in its Known Exploited Vulnerabilities (KEV) catalog. The flaws, tracked as CVE-2026-9633 and CVE-2026-9634, were disclosed on September 1, 2026.

CVE-2026-9633 impacts Redundancy Module Configuration Tool version 10.00.00. CVE-2026-9634 affects all versions from 9.00.00 up to and including 10.00.00. Both vulnerabilities arise from the application's search for required Dynamic Link Libraries (DLLs) in system directories that may have incorrect default permissions, making them writable by standard (non-administrator) users.

An attacker with local access could exploit this by placing a malicious DLL in one of the writable directories. If an administrator subsequently runs the Redundancy Module Configuration Tool, the malicious DLL is loaded into the elevated process, executing with Administrator or SYSTEM privileges. This constitutes a local privilege escalation vector.

Rockwell Automation has addressed the vulnerabilities by releasing Redundancy Module Configuration Tool version 10.01.00. The vendor also provides security best practices for customers unable to upgrade immediately, available through its support portal and security advisories page.

CISA recommends that users and organizations using the affected software upgrade to the corrected version without delay. Additional defensive guidance is published in the CISA advisory ICSA-26-244-02.