36
CVEs
5
Critical
25
High
0
KEV
0
PoC
30
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
25
MEDIUM
6
LOW
0
Monthly CVE Trend
Affected Products (26)
Rslinx Classic
4
Studio 5000 Logix Designer
3
Armorstart Lt
2
Compactlogix 5370
2
Compactlogix 5370 Compact Guardlogix 5370 Controllogix 5570 Guardlogix 5570
2
Redundancy Module Configuration Tool
2
Flex I O Ethernet Ip Adapters
2
Factorytalk Historian Machine Edition
2
Factorytalk Services Platform
1
Controllogix 5580 Compactlogix 5380 Guardlogix 5580 Compact Guardlogix 5380 1756 En4Tr
1
Factorytalk Activation Manager
1
The Flex 5000 Ethernet Ip Adapter
1
Factorytalk Datamosaix Private Cloud
1
Arena
1
Factorytalk Analytics Pavilionx
1
1756 En2 1756 En3
1
Otto Fleet Manager
1
Compactlogix Controllogix
1
Factorytalk Historian Se
1
Controlflash
1
Compactlogix 5380 Controllogix 5580
1
Factorytalk Thinmanager
1
1756 Enbt
1
1718 Aentr 1719 Aentr
1
1734 Point I O
1
Compactlogix 5380 Recovery Image Compact Guardlogix 5380 Recovery Image Compactlogix 5480 Recovery Image Controllogix 5580 Recovery Image Guardlogix 5580 Recovery Image
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-9127 | Local authenticated code execution in Rockwell Automation Studio 5000 Logix Designer allows any low-privileged authenticated user to tamper with the incorrectly-protected external-tools configuration file (CWE-863) and redirect a configured tool path to a malicious executable. Because the payload runs when a different user later invokes the external tools feature, this is effectively a privilege-crossing RCE against the engineering workstation. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; exploitation is gated by high attack complexity, a specific attack requirement, and required victim interaction (CVSS 4.0 base 7.3). | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2026-9128 | Local arbitrary code execution in Rockwell Automation Studio 5000 Logix Designer arises because the External Tools configuration stores executable paths that contain spaces without quoting (CWE-428). A low-privileged local user who can write a malicious binary into an earlier segment of the resolved search path can have Windows execute it in place of the intended tool, running code with the privileges of the operator using the application. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 score is 7.3 (High), tempered by local access, high attack complexity, a present attack requirement, and required active user interaction. | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2025-13036 | Authentication bypass in Rockwell Automation FactoryTalk Historian Site Edition allows remote attackers to obtain a valid authentication token by repeatedly hammering the login endpoint, exploiting a race condition (CWE-362) in the authentication flow. The flaw carries a CVSS 4.0 score of 9.2 with network attack vector and no privileges required, though successful exploitation depends on winning a timing window (AT:P). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.2 | 0.3% | 46 |
No patch
|
| CVE-2025-12011 | Remote denial-of-service in Rockwell Automation CompactLogix 5370, Compact GuardLogix 5370, ControlLogix 5570, and GuardLogix 5570 controllers allows a remote user to push a malformed project file that forces the controller into a Major Non-Recoverable Fault (MNRF), halting the controlled process until manual recovery. The CVSS 4.0 score of 9.2 reflects high availability impact on both the controller and the downstream physical process (VA:H/SA:H) with no authentication or user interaction required per the vendor vector. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the loss of a safety-rated (GuardLogix) controller makes availability the dominant concern. | CRITICAL | 9.2 | 0.3% | 46 |
No patch
|
| CVE-2025-12012 | Denial-of-service in Rockwell Automation Logix programmable controllers allows a remote unauthenticated attacker to write invalid file data that forces the device into a Major Non-Recoverable Fault (MNRF), halting the industrial process it controls. Rated CVSS 4.0 9.2 (Critical) with availability as the sole impact, the flaw is a CWE-120 buffer overflow reachable over the network with no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low attack complexity makes it a high-priority patch for OT environments. | CRITICAL | 9.2 | 0.3% | 46 |
No patch
|
| CVE-2025-11698 | Denial-of-service in Rockwell Automation CompactLogix/GuardLogix 5380, CompactLogix 5480, and ControlLogix/GuardLogix 5580 controllers running boot firmware below version 1.072 lets a remote unauthenticated attacker write malformed file data that forces the device into a major non-recoverable fault (MNRF), halting the controlled process until manual recovery. The flaw carries a CVSS 4.0 base of 9.2 driven purely by availability impact (no data confidentiality or integrity loss) and requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.2 | 0.3% | 46 |
No patch
|
| CVE-2026-9621 | Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the RSLinx Classic service by sending a single crafted CIP (Common Industrial Protocol) packet, after which the service must be manually restarted to restore communications. The flaw is rooted in an integer-overflow (CWE-190) style mishandling of a malformed packet and carries a CVSS 4.0 base score of 9.2 driven by high availability impact on both the service and dependent systems. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.2 | 0.3% | 46 |
No patch
|
| CVE-2026-75112 | Weak bcrypt work factor in Rockwell Automation OTTO Fleet Manager exposes stored password hashes to accelerated offline brute-force attacks when an attacker gains access to an unencrypted system backup. All versions covered by CPE cpe:2.3:a:rockwell_automation:otto®_fleet_manager:* are affected. An adjacent-network attacker with low-level access who obtains a system backup could recover credentials more easily than a properly configured bcrypt implementation would permit, potentially enabling privilege escalation or lateral movement within the OT environment. No public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 6.9 | 0.1% | 45 |
No patch
|
| CVE-2026-0647 | Unauthenticated password change in Rockwell Automation 1794-AENTR Flex I/O EtherNet/IP adapter's embedded web server allows remote attackers to overwrite the web interface password via a crafted HTTP GET request to a specific endpoint, enabling full account takeover of the industrial device. The flaw, reported by Rockwell and tracked as CVE-2026-0647 with a CVSS 4.0 base score of 8.8, has no public exploit identified at time of analysis but is trivially exploitable given no authentication, no user interaction, and low attack complexity over the network. | HIGH | 8.8 | 0.4% | 44 |
No patch
|
| CVE-2026-10714 | Authentication bypass in Rockwell Automation FactoryTalk Services Platform (FTSP) lets an authenticated low-privilege user forge JWT tokens during Okta Web Authentication because the application fails to enforce the RSA signing algorithm, permitting the classic 'alg:none' attack. A successful attacker can impersonate any authorized user, reaching system configuration and granting permissions to other systems that FTSP protects. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the alg:none technique is well documented and trivially reproducible once access is obtained. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2025-11694 | Denial-of-service in Rockwell Automation 1769 CompactLogix 5370 controllers allows remote unauthenticated attackers to induce a minor fault on the PLC by abusing Connection IDs exposed via the device's web interface and sending forged CIP traffic. The CVSS 4.0 base score of 8.7 reflects high availability impact with no authentication or user interaction required, and no public exploit has been identified at time of analysis. | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2026-0646 | Denial-of-service in Rockwell Automation 1794-AENTR FLEX I/O EtherNet/IP adapters allows remote unauthenticated attackers to fault the device and sever its connection to associated I/O modules via malformed CIP protocol requests. Recovery requires a manual reset, making this a high-impact availability issue for industrial control environments where uptime is critical. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects the network-reachable, no-privilege attack path against operational technology. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-11317 | Remote denial of service in Rockwell Automation CompactLogix and ControlLogix programmable automation controllers allows unauthenticated attackers on the network to crash the device by sending a single crafted Common Industrial Protocol (CIP) message. The fault produces a Major Non-Recoverable Fault (MNRF) that requires a full program download to recover, meaning an outage continues until an engineer physically intervenes. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.7 and OT impact make this a priority patch for affected plant floors. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-9140 | Denial-of-service in the Rockwell Automation 1719-AENTR (and companion 1718-AENTR) EtherNet/IP adapter allows remote attackers to overload the device with a UDP unicast network storm, causing loss of communication that requires a manual power cycle to recover. The CVSS 4.0 score of 8.7 reflects a high availability impact reachable over the network with no privileges or user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the low attack complexity makes it a real operational-technology availability concern. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-9653 | Denial-of-service in Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT ControlLogix EtherNet/IP communication modules lets an unauthenticated network attacker drop active device connections by sending malformed CIP Implicit (I/O) Connection packets. Because CVSS 4.0 rates only availability impact (VC:N/VI:N/VA:H) and connections recover immediately once the traffic stops, the flaw enables repeatable disruption rather than persistent outage or code execution. No public exploit identified at time of analysis, and the module is not in CISA KEV. | HIGH | 8.7 | 0.2% | 44 |
No patch
|