Loading vulnerability…
RSLinx Classic Forward Close CIP Packet Denial of Service
CVE-2026-9622 is a remotely exploitable denial-of-service vulnerability in Rockwell Automation RSLinx Classic. A crafted Common Industrial Protocol (CIP) packet directed to the Forward Close service can crash the RSLinx Classic service. The affected service must be restarted to restore operation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes the RSLinx Classic service to terminate, disrupting its communications and associated industrial automation functions until an administrator restarts the service. The reported CVSS 4.0 base score is 8.7 (High); reported impact is availability only, with no stated direct confidentiality or integrity impact.
If you can’t patch tonight, do this now.
Monitor RSLinx Classic service status for unexpected crashes and promptly restart the service if a crash occurs. Restrict network access to CIP services to authorized industrial-control-network hosts where operationally feasible.
Patch, then assume compromise.
Update RSLinx Classic to the latest available version and apply applicable Rockwell Automation security patches.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.