What is the CVSS score of CVE-2026-9621?

CVE-2026-9621 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-9621?

Within 24 hours: Inventory all RSLinx Classic deployments in production and non-production environments; implement firewall rules restricting CIP protocol access to only trusted, documented sources and segment OT networks from general corporate network access. Within 7 days: Deploy network-based intrusion detection signatures to alert on malformed CIP packets and establish automated monitoring for RSLinx Classic service availability with rapid alerting to operations staff; document and test manual restart procedures. Within 30 days: Continuously monitor Rockwell Automation security advisories and product updates for patch availability; upon patch release, conduct testing in isolated non-production environment, then deploy to production with change management approval and staged rollout approach.

RSLinx Classic CVE-2026-9621

EUVD-2026-69138 CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-09-01 Rockwell

GHSA-x222-px97-5m97

Denial Of Service Integer Overflow Rslinx Classic Rockwell Automation

9.2

CVSS 4.0 · Vendor: Rockwell

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach RSLinx CIP port on network
Delivery

Craft malformed CIP packet
Exploit

Trigger integer overflow in parser
Execution

Crash RSLinx Classic service
Impact

Communications lost until manual restart

Vulnerability Assessment

Weakness	CWE CWE-190 ASVS 5.0 V15 - Secure Coding and Architecture Integer overflow checks MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires only network reachability to the RSLinx Classic service's CIP/EtherNet/IP listener and the ability to send a crafted (malformed) CIP packet - no authentication (PR:N), no user interaction (UI:N), and no special attack requirements (AT:N) per the CVSS 4.0 vector, so it works against default configurations. The concrete prerequisite is that the target must expose the CIP protocol interface to the attacker; the primary limiting factor is therefore network exposure - hosts isolated behind OT segmentation or firewalled CIP ports (44818/2222) are not reachable. Impact is limited to a service crash (availability only); it grants no code execution or data access, and recovery requires a manual restart of the RSLinx Classic service.
Impact	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H/SA:H) describes an easy, unauthenticated, network-reachable attack with high availability impact on the vulnerable system and on subsequent systems that depend on it - a realistic and serious profile for an OT communications broker whose outage can halt HMI/SCADA visibility and control. However, impact is confined to availability: confidentiality and integrity are both N, so this is a crash/DoS, not code execution or data compromise. Countervailing signals lower urgency: there is no EPSS score provided, no POC, and no CISA KEV listing, so there is no evidence of active or automated exploitation despite the high CVSS. Net priority is genuine for ICS/OT operators - because exposure and complexity are trivial and downtime is operationally costly - but it should be triaged as an availability risk rather than a system-takeover risk. Note the score is CVSS 4.0 only; no CVSS 3.1 vector or EPSS was supplied to cross-check.
Exploit ScenarioDerived	An attacker with network access to the OT segment sends a single crafted CIP packet to the RSLinx Classic service on the EtherNet/IP port, triggering the integer-overflow condition in the packet parser and crashing the service. HMI, SCADA, and OPC clients relying on RSLinx immediately lose connectivity to downstream PLCs until an operator manually restarts the service. No authentication, user interaction, or exploit toolkit is required, though no public POC has been identified.

Act Now Prioritize within 24-48h. Why: CRITICAL + active threat signals, no patch available.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 01, 2026

Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the RSLinx Classic service by sending a single crafted CIP (Common Industrial Protocol) packet, after which the service must be manually restarted to restore communications. The flaw is rooted in an integer-overflow (CWE-190) style mishandling of a malformed packet and carries a CVSS 4.0 base score of 9.2 driven by high availability impact on both the service and dependent systems. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

RemediationAI

Patch available per vendor advisory - apply the RSLinx Classic update described in Rockwell Automation advisory SD1794 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html); an exact patched version number was not included in the provided data, so confirm the target build directly from that advisory. As compensating controls where immediate patching is not possible, restrict network reachability of the RSLinx Classic host: block or firewall inbound CIP/EtherNet/IP traffic (TCP/UDP 44818 and TCP 2222) so only trusted engineering workstations and PLC subnets can reach the service, and place the host inside a segmented OT/DMZ zone per IEC 62443 rather than exposing it to enterprise or internet-facing networks. The trade-off is that overly aggressive filtering can break legitimate PLC/HMI/OPC polling, so validate allowed peers before enforcing; because recovery requires a manual service restart, also prepare monitoring/alerting on the RSLinx process and a documented restart runbook to minimize downtime if a crash occurs.

Affected VersionsENISA

RSLinx Classic® V4.50 and prior

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

RSLinx Classic is Rockwell Automation's communication server that brokers connectivity between engineering/HMI/OPC clients and Allen-Bradley PLCs and other devices over CIP, the Common Industrial Protocol used across EtherNet/IP industrial networks. The vulnerability lies in the packet-parsing path for CIP messages: a malformed packet triggers CWE-190 (Integer Overflow or Wraparound), where an arithmetic value derived from attacker-controlled length/size fields wraps or is mishandled, corrupting parser state and crashing the service process. The single affected product per the CPE is cpe:2.3:a:rockwell_automation:rslinx_classic (all versions specified as '*'), indicating the vendor did not scope an exact version range in the machine-readable data.

Know when Rslinx Classic gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Rockwell) PRIMARY 9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

vuln.today AI 8.6 HIGH

Unauthenticated network packet with low complexity (AV:N/AC:L/PR:N/UI:N); availability-only crash (A:H, C/I:N), and S:C reflects impact on dependent PLC/HMI systems beyond the service.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

High

DescriptionCVE.org

A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover

Executive ViewAI

Why It Matters

CVE-2026-9621 is a critical denial-of-service vulnerability in Rockwell Automation RSLinx Classic that allows any unauthenticated network attacker to crash the service with a single malformed packet, requiring manual restart to restore industrial communications. Organizations operating manufacturing, process control, or other mission-critical OT environments face production stoppage risk until service is manually restored. Immediate network access controls and monitoring are essential while awaiting vendor remediation.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network segmentation and firewall rules restricting CIP protocol traffic to pre-approved source IP addresses; (2) Deploy network-based IDS/IPS with signatures for malformed CIP packet detection and alerting; (3) Establish automated service health monitoring with alert escalation to operations; (4) Prepare and validate rapid manual service restart procedures with trained staff availability; (5) Implement change control process for testing patches immediately upon Rockwell Automation release.

Threat Intelligence Overview

EPSS Score

0.3%

Top 76% exploitable

Prevalence

Medium

widely used Rockwell OT comms server, but industrial/ICS-specific footprint

Threat Intel

1 source

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CISA

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + active threat signals, no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.