CVE-2026-12663: Rockwell Automation ControlFLASH Missing Authentication Vulnerability — Detection and Remediation Guide for ICS Defenders

---
title: Suspicious Child Process Spawned by ControlFLASH
id: 3f8c2a71-9b4e-4d5a-a1c6-7e2f8b9d0c31
status: experimental
description: Detects ControlFLASH.exe spawning command interpreters, scripting engines, or other LOLBins, consistent with DLL/executable hijacking via the world-writable installation path described in CVE-2026-12663 (ICSA-26-246-03).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-03
  - https://attack.mitre.org/techniques/T1574/
author: Security Arsenal
date: 2026/03/15
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1574.001
  - attack.t1574.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\ControlFLASH.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\schtasks.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor update wrappers legitimately invoking command shells during firmware operations (verify against Rockwell release notes before tuning out)
level: high
---
title: Executable or Script Written to ControlFLASH Installation Directory
id: 8d4e1b62-2c7f-4a38-b5d9-6f1a3c8e7b42
status: experimental
description: Detects creation of executables, DLLs, or scripts inside the ControlFLASH installation path by a process other than the Rockwell installer, indicating attempt to plant a hijack payload abusing permissive ACLs from CVE-2026-12663.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-03
  - https://attack.mitre.org/techniques/T1574/
author: Security Arsenal
date: 2026/03/15
tags:
  - attack.persistence
  - attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Rockwell Automation\ControlFLASH\'
      - '\ControlFLASH\bin\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
      - '.vbs'
  filter_installer:
    Image|contains:
      - '\msiexec.exe'
      - '\InstallShield\'
      - 'Rockwell'
  condition: selection_path and selection_ext and not filter_installer
falsepositives:
  - Legitimate ControlFLASH version upgrades or Rockwell patch installers (tune filter_installer to your deployment tooling, e.g., SCCM/Intune service accounts)
level: high

// Hunt: Writes of executables/scripts into ControlFLASH paths + suspicious child processes
// Tables: DeviceFileEvents / DeviceProcessEvents (Defender for Endpoint)
let cfPath = dynamic([@"\Rockwell Automation\ControlFLASH\", @"\ControlFLASH\"]);
let suspiciousWrites = DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any (cfPath)
| where FileName has_any (".exe", ".dll", ".bat", ".ps1", ".vbs")
| where InitiatingProcessFileName !in~ ("msiexec.exe", "setup.exe")
| project WriteTime=TimeGenerated, DeviceName, FileName, FolderPath,
          InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;
let suspiciousChildren = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "ControlFLASH.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe",
                      "cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe",
                      "wmic.exe","schtasks.exe")
| project ProcTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine,
          AccountName, InitiatingProcessCommandLine;
suspiciousWrites
| union suspiciousChildren
| order by TimeGenerated desc

-- CVE-2026-12663 hunt: audit ControlFLASH install path ACLs and look for
-- recently planted executables/DLLs in the writable directory
LET cf_paths = SELECT FullPath, Mtime, Btime, Size
FROM glob(globs=[
  'C:/Program Files (x86)/Rockwell Automation/ControlFLASH/**/*',
  'C:/Program Files/Rockwell Automation/ControlFLASH/**/*'
])
WHERE FullPath =~ '\.(exe|dll|bat|ps1|vbs)$'

SELECT FullPath, Mtime AS Modified, Btime AS Created, Size,
       -- Flag files written after the ControlFLASH install date as suspicious
       Btime > (SELECT min(Btime) AS InstallTime FROM cf_paths) + 86400 AS PlantedAfterInstall
FROM cf_paths
ORDER BY Btime DESC

# CVE-2026-12663 — Verify ControlFLASH version and audit installation-path ACLs
# Run on engineering workstations (requires local admin for ACL reads)

# 1) Detect installed ControlFLASH version
$cf = Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*",
      "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
      Where-Object { $_.DisplayName -like "*ControlFLASH*" } |
      Select-Object DisplayName, DisplayVersion, InstallLocation

if ($cf) {
    Write-Host "[+] Found: $($cf.DisplayName) v$($cf.DisplayVersion)" -ForegroundColor Cyan
    if ([version]$cf.DisplayVersion -le [version]"15.07") {
        Write-Host "[!] VULNERABLE to CVE-2026-12663 — upgrade required per ICSA-26-246-03" -ForegroundColor Red
    }
} else {
    Write-Host "[-] ControlFLASH not detected on this host." -ForegroundColor Green
}

# 2) Audit ACLs on the install path for Everyone/Users write access (the root cause)
$paths = @("C:\Program Files (x86)\Rockwell Automation\ControlFLASH",
           "C:\Program Files\Rockwell Automation\ControlFLASH") |
         Where-Object { Test-Path $_ }

foreach ($p in $paths) {
    $acl = Get-Acl $p
    $risky = $acl.Access | Where-Object {
        ($_.IdentityReference -match "Everyone|BUILTIN\\Users") -and
        ($_.FileSystemRights -match "Write|Modify|FullControl")
    }
    if ($risky) {
        Write-Host "[!] Overly permissive ACL on $p :" -ForegroundColor Red
        $risky | Format-Table IdentityReference, FileSystemRights, AccessControlType
        # Harden: remove write access for Everyone/Users (test before enforcing in production OT)
        # $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone","Write","Deny")
        # $acl.AddAccessRule($rule); Set-Acl $p $acl
    } else {
        Write-Host "[+] ACLs on $p appear restrictive." -ForegroundColor Green
    }
}

# 3) Inventory recent executable writes in the install path (potential planted payloads)
foreach ($p in $paths) {
    Get-ChildItem $p -Recurse -Include *.exe,*.dll,*.bat,*.ps1,*.vbs -ErrorAction SilentlyContinue |
        Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
        Select-Object FullName, CreationTime, @{n="Signer";e={(Get-AuthenticodeSignature $_.FullName).SignerCertificate.Subject}} |
        Format-Table -AutoSize
}