The trigger decides how hard this is to pull off. There is no race and no crafted input. A standard user drops a DLL into a directory that already sits on the system path and waits for an administrator to open the tool, at which point the DLL is loaded into the elevated process and runs with Administrator or SYSTEM rights [4]. Rockwell reported both issues to CISA itself [8], and both are filed under CWE-276, incorrect default permissions, with no list of the offending directories in the advisory [5].
The version arithmetic matters for what gets fixed. CVE-2026-9633 names RM3ConfigTool.exe in 10.00.00 [2]. CVE-2026-9634 names RMConfigTool.exe across 9.00.00 to 10.00.00 inclusive [3]. The overlap on 10.00.00 means an install at that build is reachable through both binaries, while a 9.x install appears only in the wider entry [11]. The remediation is the same package either way: 10.01.00, one minor revision above the highest affected build [6][14].
Then there is the mitigation section. CISA's recommended practices here are the standard control-system set, which is to keep devices off the internet, put control networks behind firewalls isolated from business networks, and use VPNs where remote access is required [10]. None of it bears on this bug. The precondition is a local account on the host where the tool is installed plus an administrator who later launches it [12]. Segmentation that stops CIP traffic does not stop a file write into a directory the operating system already searches.
That leaves two jobs, both host-local. One is installing 10.01.00, or, for sites that cannot, Rockwell's best-practices guidance [6][7]. The other is enumerating the system path on the workstations that actually have the tool and testing each entry for standard-user write access, because the advisory does not say which entry is wrong [5]. Scope is an inventory question rather than a network one. The tool is deployed worldwide into Critical Manufacturing [9], and the exposed population on any given host is whoever can log in without admin rights. As published, the advisory carries no CVSS score in its metrics sections [13]; the mechanism is legible enough that a number would not change the work.
