Loading story…
Rockwell Automation released patches and mitigations for more than a dozen vulnerabilities affecting industrial-control hardware and software, including RSLinx Classic, CompactLogix and ControlLogix controllers, ArmorStart LT, FactoryTalk products, ControlFLASH, and the Redundancy Module Configuration Tool. Five flaws are rated high severity, while four critical/high-severity RSLinx Classic denial-of-service vulnerabilities can crash the service and require a restart; other issues could enable remote or arbitrary code execution, privilege escalation, cross-site scripting, and denial-of-service attacks.
The Canadian Centre for Cyber Security urged administrators to review Rockwell advisories SD1792, SD1794, SD1797, and SD1798 and apply available firmware and software updates. Organizations unable to patch should reduce exposure in line with vendor guidance. A ControlLogix/CompactLogix denial-of-service advisory header identifies CVE-2026-9637 as exploited, but the advisory body and CISA’s corresponding notice state that known exploitation has not been observed.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-869 warning of vulnerabilities affecting multiple Rockwell Automation products, including 1756-ENBT modules, ArmorStart LT, CompactLogix 5380, ControlLogix 5580, and RSLinx Classic. It directed administrators to review Rockwell advisories SD1792, SD1794, SD1797, and SD1798 and apply available updates.
Rockwell's advisory header for the high-severity ControlLogix and CompactLogix denial-of-service flaw CVE-2026-9637 labeled it exploited, while the advisory body said it was not exploited. CISA's corresponding advisory also said it was not aware of exploitation.
Rockwell Automation announced patches or workarounds for more than a dozen vulnerabilities across products including RSLinx Classic, Logix controllers, FactoryTalk software, ArmorStart, ControlFLASH, and the Redundancy Module Configuration Tool. The fixes addressed denial-of-service, remote and arbitrary code execution, privilege escalation, and cross-site-scripting flaws.
Italy's ACN reported newly identified vulnerabilities in Rockwell Automation products, including five rated high severity, that could enable denial-of-service, remote-code-execution, and elevation-of-privilege attacks. The notice listed CompactLogix, ControlLogix, GuardLogix, FactoryTalk Activation Manager, Historian ME, and the Redundancy Module Configuration Tool, and recommended updates or exposure-reduction measures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourceacn.gov.it
Open sourcetenable.com
Open sourcetenable.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA republished multiple Rockwell Automation advisories covering vulnerabilities across **FactoryTalk Analytics PavilionX**, **RSLinx Classic**, **CompactLogix 5370**, **Logix 5370/5570 controllers**, and **FLEX I/O EtherNet/IP Adapters** used in critical manufacturing environments worldwide. The issues include an authorization bypass in PavilionX (`CVE-2025-14272`) that could let an unauthenticated attacker perform privileged administrative actions, and a third-party flaw in RSLinx Classic (`CVE-2020-13573`) tied to out-of-bounds read and stack-based buffer overflow conditions that could cause denial of service or enable remote arbitrary code execution. Additional advisories detail multiple **CIP-related denial-of-service weaknesses** in CompactLogix and Logix controllers, including `CVE-2026-11317`, where crafted CIP messages can trigger major nonrecoverable faults requiring a program download, as well as sequence-number, source-IP, and connection-ID issues that can induce controller faults. CISA also warned that FLEX I/O EtherNet/IP Adapters version `2.012` are affected by `CVE-2026-0646`, which can fault devices through malformed CIP requests, and `CVE-2026-0647`, a critical authentication bypass in the embedded web server that allows password changes through a crafted HTTP GET request, potentially leading to account takeover and loss of availability; CISA said no known public exploitation had been reported and urged operators to isolate control networks, reduce internet exposure, and secure remote access with firewalls and updated VPNs.
Jul 12, 2026
CISA published ICS advisories warning that multiple **Rockwell Automation** products contain remotely triggerable vulnerabilities that can cause **denial-of-service (DoS)** conditions. In *ArmorStart LT* (models **290D/291D/294D** running **<= v2.002**), CISA lists multiple CVEs (including **CVE-2025-9464/9465/9466** and **CVE-2025-9278** through **CVE-2025-9283**) tied to **uncontrolled resource consumption** (CWE-400). The issue can be triggered during fuzzing of multiple **CIP** classes, causing the device’s CIP port to become unresponsive; CISA rates the condition **CVSS 7.5 (HIGH)**. A separate CISA advisory covers *ControlLogix* **1756-RM2** and **1756-RM2XT** Redundancy Enhanced Modules (firmware **all versions**) impacted by **CVE-2025-14027**, described as resource-exhaustion and memory-management problems (CWE-401) that can be triggered via crafted inputs such as malformed **Class 3** messages. Exploitation may render devices unresponsive and can lead to a major nonrecoverable fault requiring a restart; CISA also rates this **CVSS 7.5 (HIGH)** and notes broad deployment across multiple critical infrastructure sectors. A separate report about a **Johnson Controls Metasys** **SQL injection** vulnerability (**CVE-2025-26385**, **CVSS 10**) is a different vendor/product and is not part of the Rockwell advisories described above.
Jun 29, 2026
Rockwell Automation disclosed two vulnerabilities, **`CVE-2023-3595`** and **`CVE-2023-3596`**, affecting select ControlLogix EtherNet/IP communication modules in the `1756-EN2`, `1756-EN3`, and `1756-EN4` series. The flaws in the devices’ Common Industrial Protocol implementation could allow remote code execution with persistence on EN2 and EN3 modules and denial-of-service attacks on EN4 modules, creating risks that include loss of control, loss of view, theft of operational data, and disruptive or destructive process manipulation in industrial environments. Dragos said the exploit capability was linked to an unnamed APT actor, though it had not observed exploitation in the wild at the time of reporting and did not know the intended victims or sectors. Rockwell issued patches, including for some out-of-support hardware, and recommended firmware upgrades, restricting CIP-related ports, network segmentation, optional disabling of the CIP Socket Object, and monitoring for anomalous CIP traffic, firmware changes, and memory writes as part of broader ICS defensive controls.
Aug 15, 2026