Which versions of Flex 5000 Adapter are affected by CVE-2026-12659?

The Rockwell Automation FLEX 5000 EtherNet/IP adapter contains a remote denial-of-service vulnerability allowing unauthenticated network attackers to crash the module and halt industrial I/O…

How to fix or mitigate CVE-2026-12659?

Within 24 hours, inventory all FLEX 5000 adapters in production and document network exposure-specifically identifying which devices are accessible from untrusted or external networks. Within 7 days, implement network segmentation to restrict CIP (Common Industrial Protocol) traffic destined for FLEX 5000 adapters to trusted industrial control networks, configure firewall rules and access control lists to block unauthorized access, and disable remote management interfaces if not operationally required. Within 30 days, establish ongoing monitoring for Rockwell Automation security advisories for patch availability, coordinate with your industrial automation provider on remediation options, and conduct tabletop exercises validating your manual power-cycle recovery procedures to minimize incident response time.

Flex 5000 Adapter CVE-2026-12659

Q: What is the CVSS score of CVE-2026-12659?

CVE-2026-12659 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43712 HIGH

Double Free (CWE-415)

2026-07-14 Rockwell

GHSA-vxg7-9hgq-fphj

Information Disclosure The Flex 5000 Ethernet Ip Adapter Rockwell Automation

8.7

CVSS 4.0 · Vendor: Rockwell

Severity by source

Vendor (Rockwell) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote unauthenticated crafted-packet DoS with no user interaction, so AV:N/AC:L/PR:N/UI:N; impact is availability-only (module halt until power cycle), hence C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 16:05 vuln.today

CVE Published

Jul 14, 2026 - 15:14 cve.org

HIGH 8.7

DescriptionCVE.org

A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.

AnalysisAI

Remote denial-of-service in the Rockwell Automation FLEX 5000 EtherNet/IP adapter allows an unauthenticated network attacker to crash the module by sending a crafted CIP (Common Industrial Protocol) packet, halting the adapter and its associated I/O until a manual power cycle restores operation. The CVSS 4.0 score of 8.7 (High) reflects a network-reachable, no-privilege attack with high availability impact but no confidentiality or integrity loss. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation.

Technical ContextAI

The affected component is a FLEX 5000 EtherNet/IP communication adapter, an industrial I/O head module used in Rockwell/Allen-Bradley control systems to interface distributed I/O over EtherNet/IP. EtherNet/IP encapsulates the Common Industrial Protocol (CIP) over standard TCP/UDP (typically port 44818/2222), making the adapter reachable by anything on the control network. The assigned CWE-415 (Double Free) indicates the root cause is a memory-management fault in which the same heap allocation is freed more than once while parsing malformed CIP messages; the description frames this as 'improper handling of exceptional conditions,' consistent with a double-free triggered on an error/exception path in the packet parser, corrupting the allocator state and crashing the module firmware.

RemediationAI

Consult Rockwell Automation advisory SD1789 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1789.html) and apply the vendor-supplied firmware update for the FLEX 5000 EtherNet/IP adapter; no exact fixed firmware version is provided in the available data, so the precise patch level must be confirmed from that advisory (Patch available per vendor advisory). Until patched, apply OT network hygiene: restrict CIP/EtherNet/IP access (TCP/UDP 44818 and UDP 2222) to only authorized controllers and engineering workstations via managed switch ACLs or firewall rules, segment the adapter into a dedicated cell/area zone behind an industrial firewall or CIP-aware IDS, and deny EtherNet/IP traffic from IT or untrusted VLANs - trade-off: overly tight ACLs can break legitimate controller-to-adapter I/O connections, so validate against the running control configuration. Because recovery requires a manual power cycle, also ensure physical/remote power-cycling access is planned so an incident does not require prolonged plant downtime.