---METADATA---
VENDOR: Rockwell Automation
PRODUCT: 1756-EN2, 1756-EN3, 1756-ENBT
AFFECTED_VERSIONS: 1756-EN2/EN3: 12.001 and before; 1756-ENBT: 6.006
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A denial-of-service vulnerability in Rockwell Automation communication modules arises from improper validation of CIP Implicit Connection packets, allowing unauthenticated remote disruption.

Executive Summary:
A critical denial-of-service vulnerability in Rockwell Automation communication modules poses a significant risk to industrial control systems by allowing unauthenticated remote service disruption.

Vulnerability Details

CVE-ID: CVE-2026-9653

Affected Software: Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT communication modules

Affected Versions: 1756-EN2/EN3: 12.001 and before; 1756-ENBT: 6.006

Vulnerability: This is a denial-of-service vulnerability caused by improper validation of CIP Implicit Connection packets (CWE-354). The vulnerability is exploitable by an unauthenticated remote attacker with network access to the target modules.

Business Impact

The exploitation of this vulnerability can lead to a complete loss of availability for the affected communication modules. In industrial environments, such an outage can halt critical operations, cause unplanned downtime, and potentially lead to significant safety or financial consequences. With a CVSS score of 8.7, this flaw is categorized as High severity, reflecting the ease of remote exploitation and the potential for severe operational impact.

Remediation Plan

Immediate Action: Review the official Rockwell Automation security advisory (SD1780) to identify specific firmware updates or configuration changes required for your hardware revisions. Apply all recommended vendor security updates as soon as they are made available for your specific environment.

Proactive Monitoring: Monitor industrial network traffic for anomalous CIP packet patterns or unexpected spikes in traffic directed at communication modules. Implement logging on network infrastructure to identify unauthorized attempts to communicate with control system hardware.

Compensating Controls: Restrict network access to industrial communication modules by implementing strict VLAN segmentation and firewall rules that allow only authorized traffic. Utilize an Industrial Intrusion Detection System to identify and alert on malformed CIP packets or abnormal traffic volumes.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly automatable, which increases the likelihood of future exploitation attempts once technical details become more widely understood.

Analyst Recommendation

Given the High severity of this vulnerability and its direct impact on industrial availability, organizations should prioritize the identification of affected hardware within their control networks. It is imperative to apply vendor-supplied patches as soon as they become available and to maintain strict network isolation for all vulnerable communication modules to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: CompactLogix 5380 / ControlLogix 5580
AFFECTED_VERSIONS: V33 and prior, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:13:24.965Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1792.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A denial of service vulnerability in Rockwell Automation Logix controllers allows unauthenticated attackers to cause a major nonrecoverable fault via malformed CIP messages.

Executive Summary:
A critical denial of service vulnerability in Rockwell Automation Logix controllers permits unauthenticated remote attackers to crash systems, requiring a manual power cycle for recovery.

Vulnerability Details

CVE-ID: CVE-2026-9637

Affected Software: Rockwell Automation CompactLogix 5380 / ControlLogix 5580

Affected Versions: V33 and prior, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012

Vulnerability: The flaw is caused by improper validation of input length during CIP message processing (CWE-119). This vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/AC:L/AT:N/PR:N/UI:N.

Business Impact

The ability to trigger a major nonrecoverable fault in industrial control systems poses a severe risk to operational continuity. Because the device requires a physical power cycle to recover, a successful exploit could result in significant production downtime and operational disruption. The CVSS score of 8.7 reflects the high impact on system availability, which is critical in industrial environments.

Remediation Plan

Immediate Action: Review the official Rockwell Automation security advisory (SD1792) to identify specific firmware updates or configuration changes required for your specific hardware revision.

Proactive Monitoring: Monitor industrial network traffic for anomalous CIP message patterns or spikes in traffic directed at Logix controller communication ports.

Compensating Controls: Implement strict network segmentation and firewall rules to restrict access to industrial communication protocols to authorized engineering workstations only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to force a hard system fault without requiring authentication.

Analyst Recommendation

Given the potential for complete operational disruption, organizations using the affected Logix platforms must prioritize this advisory. Administrators should transition to the latest vendor-provided firmware as soon as testing permits to eliminate the underlying memory buffer vulnerability. In the interim, ensure that all affected controllers are isolated from untrusted networks to prevent remote exploitation.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: RSLinx Classic
AFFECTED_VERSIONS: V4.50 and prior
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:13:17.455Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A buffer overflow in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to trigger a denial-of-service condition via a crafted CIP packet.

Executive Summary:
A critical denial-of-service vulnerability in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the service by sending a specially crafted CIP packet.

Vulnerability Details

CVE-ID: CVE-2026-9625

Affected Software: Rockwell Automation RSLinx Classic

Affected Versions: V4.50 and prior

Vulnerability: The vulnerability is a buffer overflow (CWE-120) triggered when the application processes a crafted CIP packet containing an oversized embedded message request. This flaw is exploitable by unauthenticated remote attackers without requiring user interaction.

Business Impact

The exploitation of this vulnerability results in the disruption of industrial communication services, leading to potential operational downtime. With a CVSS score of 8.7, this high-severity flaw poses a significant threat to availability, as the service requires manual intervention and a restart to recover from the crash.

Remediation Plan

Immediate Action: Monitor the Rockwell Automation Trust Center for the release of an official security update and apply it to all affected RSLinx Classic installations immediately.

Proactive Monitoring: Implement network traffic analysis to detect anomalous CIP packets or unexpected spikes in service restarts that may indicate attempted exploitation.

Compensating Controls: Utilize industrial firewalls or deep packet inspection (DPI) capable network appliances to restrict CIP traffic to trusted sources and block malformed packets.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its network-accessible nature and the lack of authentication required to trigger the crash.

Analyst Recommendation

Given the high CVSS score and the potential for operational impact in industrial environments, organizations should prioritize restricting network access to the RSLinx Classic service. Ensure that all systems are prepared for patching as soon as the vendor releases the necessary firmware or software update.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: RSLinx Classic
AFFECTED_VERSIONS: V4.50 and prior
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:13:10.218Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
Rockwell Automation RSLinx Classic is vulnerable to a denial of service attack via a crafted CIP packet, which triggers a service crash due to insufficient data length validation.

Executive Summary:
A critical denial of service vulnerability in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the service, disrupting critical industrial communication processes.

Vulnerability Details

CVE-ID: CVE-2026-9624

Affected Software: Rockwell Automation RSLinx Classic

Affected Versions: V4.50 and prior

Vulnerability: This vulnerability is caused by an integer underflow (CWE-191) resulting from insufficient validation of data lengths within Common Industrial Protocol (CIP) packets. The flaw is remotely exploitable by an unauthenticated attacker, requiring no user interaction.

Business Impact

The ability for an unauthenticated attacker to remotely crash RSLinx Classic introduces significant operational risk. Because this software is essential for industrial communication, a service crash leads to immediate loss of visibility and control over automation hardware, resulting in unplanned downtime and potential safety hazards. With a CVSS score of 8.7, this high-severity vulnerability warrants immediate attention to prevent operational disruption.

Remediation Plan

Immediate Action: Review the Rockwell Automation security advisory SD1794 to identify if a firmware or software update is available for your specific environment and apply it immediately.

Proactive Monitoring: Monitor industrial network traffic for malformed CIP packets and observe the RSLinx Classic service for unexpected crashes or restart cycles.

Compensating Controls: Restrict network access to the RSLinx Classic service by implementing strict firewall rules and network segmentation, ensuring only authorized engineering workstations can communicate with the affected systems.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its status as an automatable, unauthenticated remote denial of service against industrial control system components.

Analyst Recommendation

Given the high CVSS score and the critical nature of industrial automation software, organizations should treat this vulnerability with high priority. Organizations must verify their current RSLinx Classic version and isolate affected systems from public or untrusted network segments until the vendor-supplied security update is applied.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: RSLinx Classic
AFFECTED_VERSIONS: V4.50 and prior
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:03:29.592Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A denial of service vulnerability in Rockwell Automation RSLinx Classic allows unauthenticated attackers to crash the service via a malformed CIP packet.

Executive Summary:
A critical vulnerability in Rockwell Automation RSLinx Classic enables unauthenticated remote attackers to trigger a denial of service condition, potentially disrupting industrial operations.

Vulnerability Details

CVE-ID: CVE-2026-9621

Affected Software: Rockwell Automation RSLinx Classic

Affected Versions: V4.50 and prior

Vulnerability: This vulnerability is caused by an integer overflow or wraparound condition (CWE-190) that occurs when the software processes malformed Common Industrial Protocol (CIP) packets. Because the vulnerability is accessible via the network without authentication (PR:N, UI:N), an attacker can remotely cause the service to crash.

Business Impact

The exploitation of this flaw leads to a complete service disruption of the RSLinx Classic application, which is a critical component for communication between industrial control systems. Given the CVSS score of 9.2, this vulnerability represents a severe operational risk that could result in significant downtime for manufacturing or process control environments.

Remediation Plan

Immediate Action: Update Rockwell Automation RSLinx Classic to the latest version provided by the vendor in the official security advisory.

Proactive Monitoring: Monitor network traffic for anomalous CIP packets and review system logs for recurring RSLinx service crashes or unexpected process terminations.

Compensating Controls: Implement network segmentation to restrict access to the RSLinx service to authorized hosts only and deploy industrial firewalls capable of inspecting and filtering malformed CIP traffic.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its automatable nature and the ability for an unauthenticated attacker to remotely disrupt industrial communications.

Analyst Recommendation

Due to the critical nature of this vulnerability and the potential for operational impact in industrial settings, administrators should prioritize patching immediately. If patching is not immediately feasible, network-level isolation of the affected RSLinx instances is strongly recommended to minimize the attack surface until the update can be applied.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: 1718-AENTR/1719-AENTR
AFFECTED_VERSIONS: 3.011
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A resource exhaustion vulnerability in the Rockwell Automation 1718-AENTR and 1719-AENTR modules allows unauthenticated, remote attackers to cause a denial-of-service.

Executive Summary:
A high-severity resource exhaustion vulnerability in Rockwell Automation 1718-AENTR and 1719-AENTR modules presents a risk of remote denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-9140

Affected Software: Rockwell Automation 1718-AENTR/1719-AENTR

Affected Versions: 3.011

Vulnerability: This issue stems from improper resource allocation (CWE-770), where the device fails to throttle resource usage, allowing an unauthenticated attacker to remotely overwhelm the system and cause a denial-of-service.

Business Impact

Exploitation of this vulnerability could result in the loss of control or monitoring capabilities for automated systems. The CVSS score of 8.7 highlights the severity of the risk to operational continuity, as the attack vector is network-based and requires no authentication.

Remediation Plan

Immediate Action: Consult the official vendor security advisory for the 1718-AENTR and 1719-AENTR modules to identify the necessary firmware update or configuration change.

Proactive Monitoring: Implement monitoring for network traffic anomalies and device resource utilization spikes that could indicate an attempt to overwhelm the module.

Compensating Controls: Apply network-level filtering to ensure that only authorized traffic can reach the affected modules, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable in environments where the device is exposed to untrusted network segments.

Analyst Recommendation

Administrators should take immediate steps to isolate these modules from public or untrusted networks while awaiting or applying official vendor remediation. Refer to advisory SD1778 for specific instructions provided by Rockwell Automation to address this resource exhaustion flaw.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: 1756-ENBT Module
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:13:32.182Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1798.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A denial-of-service vulnerability in the Rockwell Automation 1756-ENBT module allows unauthenticated attackers to crash the device by sending a specially crafted CIP packet.

Executive Summary:
A high-severity denial-of-service vulnerability in the Rockwell Automation 1756-ENBT module allows remote attackers to force a system crash, necessitating a manual restart of the device.

Vulnerability Details

CVE-ID: CVE-2026-84235

Affected Software: Rockwell Automation 1756-ENBT Module

Affected Versions: All versions

Vulnerability: This vulnerability involves a denial-of-service condition triggered by a crafted Common Industrial Protocol (CIP) packet. The flaw is remotely exploitable by an unauthenticated attacker, requiring no user interaction to cause the module to cease operation.

Business Impact

The exploitation of this vulnerability results in the immediate loss of availability for the affected industrial control module, which may lead to significant operational downtime. With a CVSS score of 8.7, this flaw poses a severe risk to production environments where continuous uptime is critical for safety and operational continuity.

Remediation Plan

Immediate Action: Migrate to the recommended hardware replacements, specifically the 1756-EN2T or 1756-EN4TR modules, as the affected hardware is deprecated or inherently vulnerable.

Proactive Monitoring: Monitor industrial network traffic for malformed CIP packets or unexpected spikes in traffic directed toward the 1756-ENBT module that might indicate scanning or exploitation attempts.

Compensating Controls: Implement strict network segmentation and firewall rules to restrict access to the affected module, ensuring that only trusted engineering workstations can communicate with the device.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for remote, unauthenticated disruption of critical industrial infrastructure.

Analyst Recommendation

Given the critical nature of industrial control systems, the inability to patch the existing hardware necessitates an immediate review of the affected deployment. Organizations should prioritize replacing the vulnerable 1756-ENBT hardware with the recommended modern equivalents to eliminate this risk entirely.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: The FLEX 5000 EtherNet/IP Adapter
AFFECTED_VERSIONS: 6.011
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A double free vulnerability exists in the Rockwell Automation FLEX 5000 EtherNet/IP Adapter, potentially leading to a denial-of-service condition.

Executive Summary:
A critical double free vulnerability in the Rockwell Automation FLEX 5000 EtherNet/IP Adapter allows unauthenticated attackers to cause a denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-12659

Affected Software: Rockwell Automation The FLEX 5000 EtherNet/IP Adapter

Affected Versions: 6.011

Vulnerability: This vulnerability is caused by a double free flaw (CWE-415), which can be triggered by an unauthenticated, remote attacker to crash the affected device.

Business Impact

Successful exploitation results in a denial-of-service, which can disrupt industrial control processes and lead to significant operational downtime. With a CVSS score of 8.7, this flaw represents a high risk to availability, particularly in production environments where system uptime is critical.

Remediation Plan

Immediate Action: Upgrade the affected device firmware to version 6.012 or later immediately.

Proactive Monitoring: Monitor network traffic for unusual patterns directed at the EtherNet/IP interface and review system logs for signs of unexpected reboots or service instability.

Compensating Controls: Utilize industrial firewalls or network segmentation to restrict access to the device to only authorized engineering workstations.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to disrupt industrial operations via a network-accessible vector.

Analyst Recommendation

Given the potential for operational disruption, administrators should prioritize the application of the vendor-provided firmware update. Ensure that all affected industrial assets are updated during the next available maintenance window to mitigate the risk of service interruption.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: 1715 EtherNet/IP Communications Module
AFFECTED_VERSIONS: 3.003 and prior
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Rockwell Automation 1715 EtherNet/IP Communications Module contains an unauthenticated debug port, allowing remote attackers to execute intrusive CLI commands and manipulate device operations.

Executive Summary:
A critical vulnerability in the Rockwell Automation 1715 EtherNet/IP Communications Module allows unauthenticated remote attackers to gain full control over the device via an exposed debug port.

Vulnerability Details

CVE-ID: CVE-2026-10577

Affected Software: Rockwell Automation 1715 EtherNet/IP Communications Module

Affected Versions: 3.003 and prior

Vulnerability: This is a missing authentication for critical function vulnerability (CWE-306). An exposed network-accessible debug port fails to enforce privilege controls, permitting an unauthenticated remote attacker to issue CLI commands, modify memory, and alter I/O states.

Business Impact

The ability to manipulate I/O states and stop tasks poses a severe risk to operational technology environments, potentially leading to physical process disruption or catastrophic equipment damage. Given the CVSS score of 10.0, this flaw represents the highest level of risk, threatening the confidentiality, integrity, and availability of critical infrastructure components.

Remediation Plan

Immediate Action: Update the 1715 EtherNet/IP Communications Module firmware to version 3.011 or later as specified by the vendor.

Proactive Monitoring: Review network access logs for unauthorized connections to the module and monitor for unexpected changes in device configuration or I/O states.

Compensating Controls: Isolate the affected devices behind a firewall or within a segmented network to restrict access to the debug port from untrusted sources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication for deep system-level commands.

Analyst Recommendation

This vulnerability is critical and requires immediate attention to prevent unauthorized remote control of industrial hardware. Organizations should prioritize firmware updates for all affected 1715 modules and enforce strict network segmentation to mitigate the risk of remote exploitation.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: 1734 POINT I/O
AFFECTED_VERSIONS: 3.023
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A resource exhaustion vulnerability exists in the Rockwell Automation 1734 POINT I/O module, allowing unauthenticated attackers to trigger a denial-of-service.

Executive Summary:
A high-severity resource exhaustion vulnerability in the Rockwell Automation 1734 POINT I/O module poses a significant risk of service disruption.

Vulnerability Details

CVE-ID: CVE-2026-10573

Affected Software: Rockwell Automation 1734 POINT I/O

Affected Versions: 3.023

Vulnerability: The device is susceptible to resource exhaustion (CWE-770) because it performs allocation of resources without proper limits or throttling, which can be exploited by an unauthenticated, remote attacker to crash the module.

Business Impact

The ability for an attacker to remotely exhaust system resources can lead to critical failures in industrial automation tasks. The CVSS score of 8.7 reflects the high impact on system availability and the relative ease of exploitation for an attacker with network access.

Remediation Plan

Immediate Action: Review the vendor security advisory at the provided reference link to determine if a patch or configuration workaround is available for your specific deployment.

Proactive Monitoring: Monitor device health metrics and network logs for anomalous behavior that suggests resource saturation or unexpected service degradation.

Compensating Controls: Implement strict network access control lists to limit communication with the I/O module to trusted controllers and engineering stations only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of resource throttling in industrial hardware is a persistent security challenge that necessitates strict perimeter defenses.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency due to the risk of remote, unauthenticated disruption. Consult the official Rockwell Automation security advisory SD1779 for the latest guidance on mitigation and available firmware updates.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: FactoryTalk Historian Machine Edition
AFFECTED_VERSIONS: Series C: 7.101, Series B: 5.202
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:10:31.358Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1796.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
Rockwell Automation FactoryTalk Historian Machine Edition contains an out-of-bounds write vulnerability that allows low-level authenticated attackers to achieve remote code execution.

Executive Summary:
A high-severity out-of-bounds write vulnerability in Rockwell Automation FactoryTalk Historian Machine Edition allows authenticated attackers to execute arbitrary code on the target device.

Vulnerability Details

CVE-ID: CVE-2025-12768

Affected Software: Rockwell Automation FactoryTalk Historian Machine Edition

Affected Versions: Series C: 7.101, Series B: 5.202

Vulnerability: This vulnerability is categorized as an out-of-bounds write (CWE-787) occurring within the historian software. An attacker who has achieved low-level authentication can trigger this flaw to achieve remote code execution on the affected device.

Business Impact

The ability for an attacker to execute arbitrary code creates a significant risk of total system compromise, including potential loss of data integrity and availability for industrial processes. With a CVSS score of 8.6, this vulnerability represents a high threat to operational technology environments. Successful exploitation may lead to unauthorized control over the historian device, which could be leveraged to disrupt manufacturing or facility operations.

Remediation Plan

Immediate Action: Review the official security advisory provided by Rockwell Automation and apply all recommended firmware or software updates as soon as they become available.

Proactive Monitoring: Monitor network traffic and system logs for anomalous activity, specifically focusing on unusual command execution patterns or unauthorized attempts to access historian services.

Compensating Controls: Implement network segmentation to restrict access to the historian device to only necessary personnel and systems, effectively limiting the potential for low-level authenticated attackers to reach the vulnerable endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to already possess low-level authentication, which serves as a barrier, though the potential for remote code execution makes the risk to the environment severe.

Analyst Recommendation

Given the potential for remote code execution and the critical nature of industrial historian software, this vulnerability poses a substantial risk to operational continuity. Administrators should prioritize the identification of affected Series B and Series C versions within their environment and coordinate with Rockwell Automation to deploy the necessary patches immediately upon release.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: DataEdgePlatform DataMosaix Private Cloud
AFFECTED_VERSIONS: <=7.07
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:12:47.782Z
SOURCES_JSON: [{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1702.html","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A vulnerability in Rockwell Automation DataEdgePlatform DataMosaix Private Cloud allows an authenticated user to escalate privileges to project administrator.

Executive Summary:
A high-severity privilege escalation vulnerability in Rockwell Automation DataEdgePlatform DataMosaix Private Cloud enables authenticated users to gain unauthorized administrative control over projects.

Vulnerability Details

CVE-ID: CVE-2024-7953

Affected Software: Rockwell Automation DataEdgePlatform DataMosaix Private Cloud

Affected Versions: <=7.07

Vulnerability: The flaw allows any authenticated user to create a project and assume the role of administrator for that specific project. This improper authorization logic permits users to perform unauthorized project modifications, including the deletion of data.

Business Impact

The ability for a standard user to gain administrative control over project resources poses a significant risk to data integrity and operational continuity. Given the CVSS score of 8.7, this vulnerability facilitates unauthorized project management actions that could lead to the loss of project assets or configuration tampering, potentially disrupting critical industrial workflows.

Remediation Plan

Immediate Action: Review the Rockwell Automation security advisory SD1702 and apply all recommended security updates or configuration changes provided by the vendor.

Proactive Monitoring: Audit user activity logs specifically for project creation events and administrative privilege assignments to identify suspicious account behavior.

Compensating Controls: Implement strict identity and access management policies to limit the number of users capable of creating projects until a patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly exploitable for authenticated attackers due to the low complexity of the attack vector.

Analyst Recommendation

Organizations utilizing affected versions of the DataEdgePlatform DataMosaix Private Cloud must prioritize the review of the vendor security advisory. Because this vulnerability allows for unauthorized administrative escalation within the platform, administrators should restrict access to project creation features until a definitive vendor patch is deployed to mitigate the risk of data compromise.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: MicroLogix
AFFECTED_VERSIONS: Rockwell Automation MicroLogix 1100, all versions
---END_METADATA---

Description Summary:
Rockwell Automation MicroLogix 1100 controllers allow remote unauthenticated attackers to cause a denial-of-service by triggering a controller fault when switching to RUN mode.

Executive Summary:
A high-severity denial-of-service vulnerability in the Rockwell Automation MicroLogix 1100 allows unauthenticated remote attackers to crash the controller during operation.

Vulnerability Details

CVE-ID: CVE-2021-33012

Affected Software: Rockwell Automation MicroLogix 1100

Affected Versions: All versions

Vulnerability: This vulnerability allows a remote, unauthenticated attacker to send specially crafted commands to the PLC. When the controller is switched to RUN mode, these commands trigger a fault, resulting in a persistent denial-of-service condition.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a severe threat to industrial availability. Exploitation forces the controller to fault, effectively disabling the automated system. This could lead to unplanned production outages, requiring manual intervention to restore normal operations.

Remediation Plan

Immediate Action: Refer to the CISA ICS advisory (ICSA-21-189-01) and apply the vendor-recommended updates or mitigating configurations immediately.

Proactive Monitoring: Monitor PLC status and error logs for unexpected fault conditions or unauthorized command sequences.

Compensating Controls: Isolate the PLC from external networks and strictly control access to the controller’s communication interfaces to prevent unauthenticated command injection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability affects all versions of the MicroLogix 1100 and leads to a total denial-of-service, it must be addressed immediately. Organizations should prioritize network isolation and vendor-provided patches to ensure the resilience of their control systems.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: MicroLogix 1400
AFFECTED_VERSIONS: Rockwell Automation MicroLogix 1400 Version 21.6 and below.
---END_METADATA---

Description Summary:
Rockwell Automation MicroLogix 1400 controllers are vulnerable to a buffer overflow via crafted Modbus packets, potentially causing a denial-of-service or unauthorized register manipulation.

Executive Summary:
A high-severity buffer overflow vulnerability in Rockwell Automation MicroLogix 1400 controllers allows remote, unauthenticated attackers to crash the system or modify sensitive register values.

Vulnerability Details

CVE-ID: CVE-2021-22659

Affected Software: Rockwell Automation MicroLogix 1400

Affected Versions: Rockwell Automation MicroLogix 1400 Version 21.6 and below.

Vulnerability: This is a classic buffer overflow (CWE-120) triggered when an unauthenticated attacker sends a specially crafted Modbus packet. This interaction allows the attacker to retrieve or modify register values, or crash the controller, leading to a denial-of-service condition.

Business Impact

The CVSS score of 8.6 reflects the high risk of unauthorized control over industrial processes. Successful exploitation could compromise the integrity of the process control loop, causing physical system crashes or unauthorized changes to operational parameters, which could lead to significant safety risks and operational downtime.

Remediation Plan

Immediate Action: Disable Modbus TCP support on the affected MicroLogix 1400 controllers if the protocol is not strictly required for operational functionality.

Proactive Monitoring: Implement network traffic analysis to detect anomalous Modbus packets or unauthorized attempts to access register data.

Compensating Controls: Use industrial firewalls or deep packet inspection (DPI) to filter and block malformed Modbus traffic before it reaches the controller.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the risk of remote, unauthenticated access and potential denial-of-service, organizations should immediately assess their reliance on Modbus TCP and disable the service where unnecessary. Apply vendor-recommended mitigations to protect the controller from crafted packet attacks and maintain strict network isolation.

---METADATA---
VENDOR: Rockwell Automation
PRODUCT: MicroLogix and ControlLogix
AFFECTED_VERSIONS: See advisory for specific series/versions of MicroLogix 1400 and 1756 ControlLogix modules.
---END_METADATA---

Description Summary:
Rockwell Automation controllers allow unauthenticated remote attackers to modify IP configurations, causing communication loss even when set to Hard RUN mode.

Executive Summary:
An unauthenticated remote attack vulnerability in Rockwell Automation controllers enables attackers to modify network settings, resulting in a denial-of-service condition.

Vulnerability Details

CVE-ID: CVE-2018-17924

Affected Software: Rockwell Automation MicroLogix 1400 and 1756 ControlLogix Communications Modules

Affected Versions: MicroLogix 1400 Series A, B, C; 1756-ENBT, 1756-EWEB, 1756-EN2F, 1756-EN2T, 1756-EN2TR, and 1756-EN3TR modules.

Vulnerability: This is a remote, unauthenticated vulnerability where an attacker sends a CIP connection request to modify the device's IP configuration. This action causes a loss of system communication as the device is forced to a new, potentially unreachable IP address, even while in Hard RUN mode.

Business Impact

The CVSS score of 8.6 highlights the critical impact of this vulnerability on operational technology (OT) environments. Successful exploitation results in immediate denial-of-service for the affected controller, potentially halting industrial processes and creating significant safety and operational hazards.

Remediation Plan

Immediate Action: Review the CISA ICS advisory (ICSA-18-310-02) and apply the recommended vendor updates or configuration changes immediately.

Proactive Monitoring: Monitor network traffic for unauthorized CIP connection requests or unexpected IP configuration changes within the control network.

Compensating Controls: Implement strict network segmentation and firewall rules to restrict access to the controller’s communication ports, ensuring only trusted devices can interact with the CIP protocol.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the existence of public exploit code, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly dangerous in industrial settings where availability is critical. Organizations must immediately restrict network access to affected controllers and prioritize applying patches to prevent unauthorized modification of network settings.