Which versions of 1719-AENTR are affected by CVE-2026-9140?

Rockwell Automation's 1719-AENTR and 1718-AENTR EtherNet/IP adapters are vulnerable to an unauthenticated denial-of-service attack (CVE-2026-9140, CVSS 8.7) exploitable over the network that disrupts…

How to fix or mitigate CVE-2026-9140?

Within 24 hours, inventory all deployed Rockwell Automation 1719-AENTR and 1718-AENTR adapters and identify which are externally or broadly internally accessible. Within 7 days, implement network segmentation restricting UDP access to these devices to authorized sources only, enable rate limiting and ingress filtering on interfaces connecting to the adapters, and configure device-level logging to detect anomalous traffic patterns. Within 30 days, establish vendor communication channels with Rockwell Automation to track patch availability, evaluate relocation of critical instances to isolated network segments, and develop rapid power-cycle recovery procedures with your operations teams. Continuously monitor Rockwell security advisories for patch release and schedule upgrade windows accordingly.

1719-AENTR CVE-2026-9140

Q: What is the CVSS score of CVE-2026-9140?

CVE-2026-9140 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43693 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 Rockwell

GHSA-59qg-236r-79mg

Denial Of Service 1718 Aentr 1719 Aentr Rockwell Automation

8.7

CVSS 4.0 · Vendor: Rockwell

Severity by source

Vendor (Rockwell) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable UDP flood with no auth or interaction and low complexity (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H, C:N/I:N) with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:34 vuln.today

CVE Published

Jul 14, 2026 - 14:52 cve.org

HIGH 8.7

DescriptionCVE.org

A denial-of-service security issue exists in the 1719-AENTR. The security issue stems from improper handling of a UDP unicast network storm, which causes the device to become overloaded and lose communication. A power cycle is required to recover.

AnalysisAI

Denial-of-service in the Rockwell Automation 1719-AENTR (and companion 1718-AENTR) EtherNet/IP adapter allows remote attackers to overload the device with a UDP unicast network storm, causing loss of communication that requires a manual power cycle to recover. The CVSS 4.0 score of 8.7 reflects a high availability impact reachable over the network with no privileges or user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the low attack complexity makes it a real operational-technology availability concern.

Technical ContextAI

The 1718-AENTR and 1719-AENTR are Rockwell Automation FLEX 5000 EtherNet/IP network adapter modules used to interface distributed I/O with Logix controllers in industrial automation environments. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the device does not adequately rate-limit or bound the resources consumed when processing high volumes of UDP unicast traffic. EtherNet/IP implicit (I/O) messaging relies heavily on UDP, so a sustained unicast flood exhausts the adapter's processing/memory resources, driving it into an overloaded, non-communicative state from which it cannot self-recover without a power cycle.

RemediationAI

Consult Rockwell Automation advisory SD1778 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1778.html) for the vendor-recommended fixed firmware; an exact patched version is not specified in the provided data, so treat patch status as 'Patch available per vendor advisory' pending confirmation of the exact release. Because recovery requires a manual power cycle, prioritize network-level compensating controls: segment the adapters onto an isolated OT/control VLAN behind an industrial firewall, restrict EtherNet/IP UDP traffic (notably UDP/2222 implicit I/O and UDP/44818) to only authorized controllers, and apply rate-limiting or storm-control on switch ports serving these devices to blunt unicast floods. Trade-offs: aggressive rate-limiting or storm-control thresholds set too low can drop legitimate high-rate I/O traffic and disrupt control loops, so tune against normal traffic baselines, and strict segmentation may complicate remote engineering access.