Write permission on a program directory is an execution primitive. Windows loads executables and libraries out of that directory when the tool starts, so whoever can write there gets to choose what the tool loads. The Everyone group includes the least trusted local account on the machine [2]. Put a file into C:\Program Files (x86)\ControlFLASH\0001, wait for a controls engineer to launch the firmware updater, and the code runs with that engineer's token [6][3]. The account trusted to push firmware into controllers is, by construction, a well provisioned account.
That is also the ceiling. CISA says there is no remote vector and no reported exploitation [7]. The precondition is a second, lower privileged local account on the same workstation as the ControlFLASH user [13]. On a single admin engineering laptop that nobody else logs into, there is nothing to escalate from and this is housekeeping. On a shared control room workstation with contractor logins and an operator account, it converts a foothold into the engineer's rights.
The labelling is worth a minute. The advisory files the relevant weakness as CWE-306, Missing Authentication for Critical Function [10], while the text in the same document describes an installer granting write permissions to Everyone [2]. Those are not the same defect, and the Metrics section carries no CVSS score at all [11]. Anyone who triages OT advisories by severity band, or who pivots on weakness class to find related exposure across a vendor's toolchain, will sort CVE-2026-12663 into the wrong pile.
Rockwell reported the bug to CISA itself and fixed it one release past the last affected build, 15.07 to 15.08 [8][5][14]. The interim workaround is four steps in one folder's Properties dialog and touches only the install directory on the workstation, so no controller gets re-flashed to apply it [12]. That asymmetry is the useful part of this advisory: the remediation cost sits entirely on the Windows side, where change control is cheaper than it is on anything holding a process.
ControlFLASH is deployed worldwide, and CISA lists critical manufacturing, energy, and water and wastewater as the sectors that run it [9]. That figure sets how many workstations need an ACL check, not how fast. The advisory went out 2026-09-03 [1]. The pattern to keep in view is not this one directory, but firmware update tooling being the softest thing on a hardened plant floor, because it is the software everyone assumes is already trusted.
