EUVD-2026-43668
GHSA-269w-m449-w5rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Arena model file
-
DeliveryDeliver file to target engineer
-
ExploitUser opens file in Arena
-
ExecutionTrigger out-of-bounds write in Siman parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious Arena Simulation model file that is parsed by the model.exe (Siman) component - the specific triggering condition is malformed/oversized user-supplied data in that model file causing an out-of-bounds write. Limiting factors: the attack vector is local (AV:L), so there is no remote/network-reachable path; user interaction is required (UI:P), meaning the attack fails without a user actively opening the crafted file; and the vendor rates it PR:L, implying some existing local privilege or context may be needed, though this conflicts with the description's pure file-open premise and should be verified. Code runs only in the context of the current user, and no scope change affects other systems (SC:N/SI:N/SA:N). |
| Impact | The vendor-supplied CVSS 4.0 base score is 7.0 with vector AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H - a local attack vector requiring some privilege and passive user interaction, with high confidentiality, integrity, and availability impact but no scope change to other systems. The high-impact triad reflects full code execution, but the AV:L + UI:P combination materially lowers practical risk: an attacker cannot reach this over the network and must convince a user to open a malicious file. There is no EPSS probability, no CISA KEV listing, and no POC reference in the data, so there is no signal of active or automated exploitation - this is a real but not urgent priority, driven by impact rather than by exploitability. One inconsistency worth flagging: the vendor assigned PR:L, yet the description only requires 'convincing a user to open a malicious file,' which normally implies no attacker privileges (PR:N) - this discrepancy should be verified with the vendor advisory before finalizing prioritization. |
| Exploit ScenarioDerived | An attacker crafts a malicious Arena Simulation model file that triggers the out-of-bounds write in the Siman parser and emails it to a plant or process engineer, perhaps disguised as a shared simulation project. When the victim opens the file in Arena, the malformed data corrupts memory in model.exe and executes attacker-supplied code with the privileges of the logged-in user. No public exploit code is currently identified, and the local vector plus required user interaction mean the attack hinges on successful social engineering. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the model.exe (Siman) component when a victim opens a maliciously crafted simulation model file. The flaw lets an attacker run code in the context of the current user by tricking an operator or engineer into opening a booby-trapped file, making it a client-side, file-delivery RCE rather than a remotely reachable network service bug. No public exploit has been identified at time of analysis, and no EPSS or CISA KEV data was provided, so real-world exploitation appears limited to social-engineering-driven targeting.
RemediationAI
Apply the update described in Rockwell Automation Security Advisory SD1784 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1784.html); a patch is available per the vendor advisory, but no exact fixed version number was included in the provided data, so confirm and install the specific patched build listed by Rockwell. Because exploitation depends entirely on opening a malicious model file, the most effective compensating control until patching is to only open Arena model files from trusted, verified sources and to treat unsolicited or externally-sourced .doe/model files as suspicious - the trade-off is workflow friction for teams that routinely exchange models. Additional hardening includes running Arena under a least-privileged, non-administrative user account to limit the blast radius of code executed in the current process context, and using application allow-listing or endpoint controls to restrict where model.exe can be launched from; these controls reduce impact but do not prevent the initial code execution.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Arena Simulation is Rockwell Automation's discrete-event simulation product used to model manufacturing, logistics, and process workflows; the affected model.exe is its underlying Siman simulation engine that parses model/experiment files. The root cause is CWE-787 (Out-of-bounds Write): the Siman parser fails to properly validate the size or bounds of user-supplied fields in a model file before writing them into memory, corrupting adjacent memory structures. Such memory corruption in a native Windows desktop parser can typically be steered from a simple crash toward control of the instruction pointer, which is why the vendor tags this as Buffer Overflow / Memory Corruption / RCE. No specific affected-version list or CPE string was supplied in the intelligence beyond the product identification.
Know when Arena gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File-open RCE needs no attacker privileges (PR:N) but requires the victim to open a crafted file (UI:R) locally (AV:L); full code execution yields C/I/A:H, differing from vendor's PR:L.
Primary rating from Vendor (rockwellautomation).
CVSS VectorVendor: rockwellautomation
DescriptionCVE.org
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.
Executive ViewAI
CVE-2026-8085 is a high-severity code execution vulnerability in Rockwell Automation Arena Simulation that allows attackers to compromise engineering and operator workstations through crafted simulation files; no public exploit identified at time of analysis. Although the attack requires social engineering to deliver malicious files, the unavailable patch means organizational exposure will persist indefinitely without mitigation. Manufacturing operations face direct risk to workstations managing process simulations and training environments if personnel open untrusted model files.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict simulation model file distribution exclusively to documented internal trusted sources; (2) implement email and web content filtering to block Arena Simulation model files from external networks; (3) deploy security awareness training targeting social engineering and file validation for engineering and operations staff; (4) disable Arena Simulation on workstations where not operationally critical; (5) establish behavioral monitoring and process logging for model.exe to detect execution anomalies indicative of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature. Rated critical severity (CVSS 9.8), this
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the siman
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the linke
Arbitrary code execution in Rockwell Automation Arena Simulation is possible through an out-of-bounds write in the expmt
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflo
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read o
Exploit-DB