AutomationDirect Ships Productivity Suite v4.7.0.47 to Plug Six Security Holes, Two Let Attackers Hijack Kernels

On July 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an advisory for six vulnerabilities in AutomationDirect Productivity Suite, the engineering software used to program and maintain industrial controllers. AutomationDirect has shipped version 4.7.0.47, which closes all six security holes, and is urging every operator still running version 4.6.2.2 or earlier to update immediately. The two most dangerous flaws can give a local attacker complete control over the workstation—including kernel-level code execution—simply by sending a malformed IOCTL request.

The Six Flaws Demanding Your Attention

All six CVEs affect Productivity Suite v4.6.2.2 and earlier. They are not remotely exploitable, but that hardly makes them benign in an industrial setting. The update to v4.7.0.47 resolves every one of them. Here is the breakdown:

The two high-severity write bugs are the attention-getters. An attacker with any foothold on the engineering workstation can craft a specially formed IOCTL request—a standard method for user-mode software to talk to device drivers—and corrupt kernel memory. The result can be full privilege escalation or a system turned so unstable it becomes unusable. CVE-2026-60073 stands out because it requires physical access to a USB port, an attack vector that feels more like sabotage than remote cybercrime but is just as possible on a factory floor where maintenance laptops and removable drives trade hands daily.

Why Factory Floor PCs Are the Real Target

If you are a plant engineer, a maintenance technician, or an IT admin responsible for manufacturing cells, this advisory is not theoretical. Productivity Suite is the software you use to configure, program, and troubleshoot AutomationDirect controllers running on production lines. Many of those engineering stations live outside the locked-down corporate network—often sitting right next to a machine with a USB cable dangling from a panel.

The local-access requirement doesn’t neuter the threat; it refocuses it. These workstations are touched by multiple shifts, visited by contractors, and occasionally left logged in during a busy changeover. A disgruntled employee, a compromised remote-support session, or a malicious USB stick from a supply-chain partner could all turn a local vulnerability into a production-stopping event or a data leak. CISA’s own recommended mitigations—disconnecting the workstation from internet and corporate LANs, restricting physical access, and using application whitelisting—are telltale signs that even agencies see these machines as ripe targets.

For admins, the risk is compounded by the fact that many industrial PCs are not enrolled in standard patch management. They often run older Windows builds, get updates manually, and languish for months without a security audit. Finding every Productivity Suite installation in your environment is step one, and it is harder than it sounds.

How ICS Software Updates Get Neglected

Productivity Suite is not a typical Windows application that auto-updates through a store or system-agent. It belongs to a class of industrial control software that gets installed once, often via a technician’s USB stick, and then rarely revisited. Version-checking requires launching the application or inspecting the file system, not looking in “Settings > Apps.” When the machinery works, there is enormous inertia against touching the programming station.

This advisory arrives without reports of active exploitation, but waiting for a proof-of-concept to circulate on exploit forums is a dangerous game. Past ICS advisories for similar software show that once an exploit becomes public, threat actors repurpose it for ransomware or intellectual-property theft against manufacturers. The fact that these flaws are local only means that a motivated insider or an attacker who has already gained initial access via phishing can pivot to full control.

AutomationDirect’s recommended update path is straightforward: download the v4.7.0.47 installer from the official software downloads page and run it on each affected machine. For organizations that cannot patch immediately, CISA offers a list of compensating controls—network isolation, physical access restrictions, application whitelisting, log monitoring, and secure backups—that buy time but do not replace the fix.

Your 6-Step Remediation Roadmap

Putting the advisory into practice means more than forwarding an email. Use this checklist to get every productivity station protected.

1. Inventory every Productivity Suite installation. Scan asset lists, maintenance records, and procurement logs. Include spare laptops, vendor-managed systems, and machines kept for backup or recovery. Record hostname, location, installed version, and whether the system is actively managed.
2. Confirm the version. Any installation at v4.6.2.2 or earlier is vulnerable. If you can’t verify a version because a machine is offsite or locked, flag it for follow-up—don’t assume it is safe. A blank entry is not a patch.
3. Obtain the v4.7.0.47 installer. Download from AutomationDirect’s support portal. Use your normal software-acquisition process to check file integrity and store the installer in a secure, accessible location.
4. Validate in a test environment. If your change-control procedure allows, deploy the update on a non-production system first. At minimum, confirm the installer reaches the required version and that no site-specific customizations break.
5. Deploy under change control. Schedule updates during a maintenance window, assign ownership, and document each step. If a system cannot be updated right away, record the reason, apply compensating controls, and set a hard retry date.
6. Record the post-update version. For every host, log the new version number, the date, and the responsible admin. An audit trail proves you moved out of the vulnerable range—closing a ticket is not enough.

Prioritize systems that have broad user access, support removable drives, or sit outside normal patch cycles. The laptop a contractor plugs into the PLC once a quarter is just as dangerous as the always-on engineering station—maybe more so, because nobody remembers to check its version.

Futureproofing Your Industrial Windows Boxes

CISA’s advisory is a reminder that industrial software runs on commodity Windows PCs and is subject to the same kernel-level weaknesses as any other application. AutomationDirect has committed to a fix; now the responsibility shifts to the operators. The coming months will likely bring more ICS advisories as researchers continue probing the driver interfaces that bridge software and hardware.

Your best defense is not a one-off patch sprint but a sustainable routine: recurring software inventories, documented update processes for all industrial tools, and strict control over removable media and remote access. When the next advisory drops—and it will—you won’t have to start from zero.