Loading vulnerability…
CIP Message Processing DoS in Rockwell Automation Logix Controllers
CVE-2026-9637 is a high-severity denial-of-service vulnerability in Rockwell Automation CompactLogix 5380 and ControlLogix 5580 Logix platforms. CIP message processing improperly validates input length values. A malformed CIP message can cause the controller to enter a major nonrecoverable fault (MNRF), from which recovery requires a power cycle.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation renders the affected Logix controller unavailable by triggering an MNRF. The condition is nonrecoverable through normal operation and requires a physical power cycle, creating a potentially significant operational-technology availability and process-disruption risk. The reported impact is limited primarily to availability.
If you can’t patch tonight, do this now.
Until patches are applied, restrict access to affected controllers and CIP services to authorized industrial-control network hosts, limit unnecessary network exposure, and monitor for controller fault conditions. Power-cycle controllers that enter an MNRF state to restore service.
Patch, then assume compromise.
Apply the vendor-provided patches or firmware updates for affected CompactLogix 5380 and ControlLogix 5580 platforms.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.