Rockwell Automation Patches More Than a Dozen Product Vulnerabilities
Summary
Rockwell says patches or workarounds are available for more than a dozen vulnerabilities across its industrial products, including DoS, remote code execution and privilege escalation flaws. Exploitation status for CVE-2026-9637 is inconsistent.
Key points
- Rockwell Automation announced patches or workarounds for more than a dozen vulnerabilities across its industrial automation products.
- Four critical and high-severity DoS flaws in RSLinx Classic can crash the service, requiring a restart.
- CVE-2026-9637 is a high-severity DoS flaw in ControlLogix and CompactLogix controllers; Rockwell's advisory conflicts on whether it is exploited, while CISA says it is not aware of exploitation.
- Other DoS flaws affect 1756-ENBT, Logix controllers and FactoryTalk Historian Machine Edition.
- FactoryTalk Historian Machine Edition has a high-severity remote code execution flaw; FactoryTalk Activation Manager has a flaw allowing authenticated attackers elevated access to files, processes and system resources.
- Rockwell patched XSS and DoS vulnerabilities in ArmorStart Distributed Motor Controllers, and an arbitrary-code-execution flaw in ControlFLASH.
- The Redundancy Module Configuration Tool has a high-severity privilege escalation flaw.
Article Details
- Vulnerability Types
- Denial of service
- Remote code execution
- Privilege escalation
- Cross-site scripting
- Unauthorized access to files, processes, and system resources with elevated privileges
- Severity
- Critical and high
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- partial
CVE
Vendors
Products
1756-ENBT moduleDoS vulnerabilities have also been addressed by Rockwell in 1756-ENBT, Logix controllers (third-party component), and FactoryTalk Historian Machine Edition.ArmorStart Distributed Motor ControllersMultiple XSS vulnerabilities that can lead to malicious script execution have been patched in ArmorStart Distributed Motor Controllers, along with a DoS issue impacting the web server.CompactLogixRockwell’s advisory for CVE-2026-9637, a high-severity DoS flaw in ControlLogix and CompactLogix controllers, flags the vulnerability as exploited.ControlFLASHThe ControlFLASH firmware management utility is affected by a vulnerability that “could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker’sControlLogixRockwell’s advisory for CVE-2026-9637, a high-severity DoS flaw in ControlLogix and CompactLogix controllers, flags the vulnerability as exploited.FactoryTalk Activation ManagerIn FactoryTalk Activation Manager, Rockwell resolved a high-severity flaw that allows an authenticated attacker to access files, processes and system resources with elevated privileges.FactoryTalk Historian Machine EditionDoS vulnerabilities have also been addressed by Rockwell in 1756-ENBT, Logix controllers (third-party component), and FactoryTalk Historian Machine Edition.Logix controllersDoS vulnerabilities have also been addressed by Rockwell in 1756-ENBT, Logix controllers (third-party component), and FactoryTalk Historian Machine Edition.Redundancy Module Configuration ToolThe Redundancy Module Configuration Tool is affected by a high-severity privilege escalation flaw.RSLinx ClassicIt covers four critical and high-severity denial-of-service (DoS) issues affecting the RSLinx Classic communications software.