Loading vulnerability…
Improper CIP Security certificate revocation handling in Rockwell Automation Logix controllers and EN4 modules
CVE-2026-9636 is a certificate validation flaw affecting Rockwell Automation CompactLogix 5380, ControlLogix 5580, GuardLogix 5580, Compact GuardLogix 5380, and 1756-EN4TR devices in versions 36 through 37. The vulnerability is in CIP Security certificate revocation handling: the controller does not properly reject certificates that chain through an intermediate certificate revoked via a Certificate Revocation List. As a result, a certificate path that should be considered untrusted may still be accepted during connection establishment, weakening the intended trust enforcement of CIP Security.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a network-based attacker to establish a connection using a certificate that should no longer be trusted. This can bypass CIP Security trust protections and enable unauthorized access to protected communications or services that rely on certificate-based authentication. Available scoring information indicates confidentiality impact, with no confirmed integrity or availability impact.
If you can’t patch tonight, do this now.
Until patched, restrict network access to CIP Security-enabled interfaces to trusted management and control networks, minimize exposure of affected controllers and communication modules to untrusted or shared networks, and tightly control issuance and deployment of certificates within the industrial PKI. Monitor for unexpected certificate-authenticated connections and review revocation management processes to reduce the chance that certificates chaining to revoked intermediates remain usable in the environment.
Patch, then assume compromise.
Apply the vendor-provided fix or upgrade to a release that corrects CIP Security certificate revocation handling for the affected product lines and versions. Validate that certificate chain processing correctly rejects certificates signed by revoked intermediate certificate authorities and review vendor advisory SD1788 for product-specific update guidance.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.