Loading vulnerability…
RSLinx Classic Malformed CIP Packet Denial of Service
CVE-2026-9621 is an improper-input-handling vulnerability in Rockwell Automation RSLinx Classic. The service does not safely handle a malformed Common Industrial Protocol (CIP) packet, allowing a crafted packet to crash the RSLinx Classic service. Service recovery requires a restart.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can cause a denial of service by crashing the RSLinx Classic service. The condition affects availability; no direct confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
Restrict network access to systems running RSLinx Classic so that only authorized industrial devices and management hosts can send CIP traffic. Monitor for and, where feasible, filter malformed CIP packets.
Patch, then assume compromise.
Restart the RSLinx Classic service after a crash to restore operation. No vendor patch, fixed version, or other permanent remediation is specified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.