15
CVEs
1
Critical
11
High
0
KEV
0
PoC
12
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
11
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (26)
Rslinx Classic
4
Studio 5000 Logix Designer
3
Armorstart Lt
2
Compactlogix 5370
2
Compactlogix 5370 Compact Guardlogix 5370 Controllogix 5570 Guardlogix 5570
2
Redundancy Module Configuration Tool
2
Flex I O Ethernet Ip Adapters
2
Factorytalk Historian Machine Edition
2
Factorytalk Services Platform
1
Controllogix 5580 Compactlogix 5380 Guardlogix 5580 Compact Guardlogix 5380 1756 En4Tr
1
Factorytalk Activation Manager
1
The Flex 5000 Ethernet Ip Adapter
1
Factorytalk Datamosaix Private Cloud
1
Arena
1
Factorytalk Analytics Pavilionx
1
1756 En2 1756 En3
1
Otto Fleet Manager
1
Compactlogix Controllogix
1
Factorytalk Historian Se
1
Controlflash
1
Compactlogix 5380 Controllogix 5580
1
Factorytalk Thinmanager
1
1756 Enbt
1
1718 Aentr 1719 Aentr
1
1734 Point I O
1
Compactlogix 5380 Recovery Image Compact Guardlogix 5380 Recovery Image Compactlogix 5480 Recovery Image Controllogix 5580 Recovery Image Guardlogix 5580 Recovery Image
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-9621 | Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the RSLinx Classic service by sending a single crafted CIP (Common Industrial Protocol) packet, after which the service must be manually restarted to restore communications. The flaw is rooted in an integer-overflow (CWE-190) style mishandling of a malformed packet and carries a CVSS 4.0 base score of 9.2 driven by high availability impact on both the service and dependent systems. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.2 | 0.3% | 46 |
No patch
|
| CVE-2026-75112 | Weak bcrypt work factor in Rockwell Automation OTTO Fleet Manager exposes stored password hashes to accelerated offline brute-force attacks when an attacker gains access to an unencrypted system backup. All versions covered by CPE cpe:2.3:a:rockwell_automation:otto®_fleet_manager:* are affected. An adjacent-network attacker with low-level access who obtains a system backup could recover credentials more easily than a properly configured bcrypt implementation would permit, potentially enabling privilege escalation or lateral movement within the OT environment. No public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 6.9 | 0.1% | 45 |
No patch
|
| CVE-2026-19472 | Rockwell Automation's ArmorStart LT industrial motor control device contains a denial-of-service flaw in its embedded web server, exploitable by sending a crafted HTTP PUT request with no authentication or special preconditions. The root cause (CWE-770) is improper resource throttling during HTTP PUT processing, which causes the web server to become unavailable. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the unauthenticated network attack surface in an OT/ICS context makes this a material operational risk wherever the device's web interface is reachable. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-9637 | Unauthenticated remote denial-of-service in Rockwell Automation CompactLogix 5380 and ControlLogix 5580 industrial controllers allows a network-adjacent attacker to trigger a Major Nonrecoverable Fault (MNRF) by sending a malformed CIP message with an invalid input length, requiring a physical power cycle to restore controller operation. The vulnerability is rooted in CWE-119 (improper buffer bounds restriction) during CIP message processing on EtherNet/IP-accessible PLCs. No public exploit code or active exploitation has been identified at the time of this analysis, but the zero-prerequisite network attack surface on safety-critical industrial hardware makes this a prioritized remediation target for OT security teams. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-9622 | Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the RSLinx Classic communication service by sending a single crafted CIP packet targeting the Forward Close service. Because RSLinx Classic acts as the primary communication bridge between engineering workstations and Allen-Bradley PLCs, a crash forces a manual service restart and can halt production operations in industrial environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-9624 | Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the communication service by sending a specially crafted CIP packet with a manipulated data length field. The root cause is an integer underflow (CWE-191) in the packet length validation routine, causing the service to terminate and requiring a manual restart to recover. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the zero-barrier network attack vector against a critical ICS communication layer makes this a high-priority remediation target. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-9625 | Unauthenticated denial-of-service in Rockwell Automation RSLinx Classic allows a remote attacker to crash the communications service by sending a crafted CIP packet containing an oversized embedded message request. The buffer overflow (CWE-120) causes the RSLinx Classic service to terminate, requiring manual restart to restore industrial device connectivity. In OT/ICS environments where RSLinx Classic bridges engineering workstations to Allen-Bradley PLCs and HMIs, service loss can halt production operations or degrade visibility into live industrial processes. No public exploit or CISA KEV listing confirmed at time of analysis. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2025-12768 | Remote code execution in Rockwell Automation FactoryTalk® Historian Machine Edition allows an adjacent-network attacker holding low-privilege credentials to fully compromise the historian host via a memory corruption flaw. The root cause is CWE-787 (Out-of-bounds Write), consistent with a buffer overflow in the historian's network-facing service, yielding full confidentiality, integrity, and availability impact on the affected device. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at the time of analysis. | HIGH | 8.6 | 0.3% | 43 |
No patch
|
| CVE-2026-16675 | Privilege escalation in Rockwell Automation FactoryTalk® Activation Manager exposes authenticated local Windows users to full SYSTEM-level access by exploiting visible console windows spawned by the installer's custom actions during installation or repair operations. Any low-privileged user present on the machine during an install or repair sequence can interact with these unprotected, SYSTEM-privileged console windows to launch an unrestricted command shell. No public exploit has been identified at time of analysis, but the attack technique - console window hijacking during elevated installer operations - is a well-documented Windows privilege escalation class requiring minimal skill once the precondition is met. | HIGH | 8.5 | 0.1% | 42 |
No patch
|
| CVE-2026-6071 | Remote code execution in Rockwell Automation Arena's DOE file parser allows a network-reachable attacker to write beyond the boundary of an allocated object and execute arbitrary code within the context of the running Arena process. Affected users must be socially engineered into opening a maliciously crafted Design of Experiments (DOE) file or visiting a page that triggers the parse. The CVSS 4.0 score of 7.5 reflects high attack complexity and mandatory active user interaction, reducing real-world exploitability despite the high-severity memory corruption impact. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-12663 | Insecure installation directory permissions in Rockwell Automation ControlFLASH™ expose any local user account to arbitrary code execution by allowing write access to the product's installation folder for the Windows 'Everyone' group. An attacker with low-privileged local access can plant a malicious binary or DLL in the installation directory, which then executes at the permission level of whichever user subsequently launches ControlFLASH - potentially a privileged operator in an OT environment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.0 | 0.1% | 35 |
No patch
|
| CVE-2026-9633 | DLL hijacking in Rockwell Automation's Redundancy Module Configuration Tool (RM3ConfigTool.exe) allows a local low-privileged attacker to escalate to Administrator or SYSTEM privileges by planting a malicious DLL in a writable system PATH directory before an administrator launches the utility. The root cause is CWE-276 (Incorrect Default Permissions): the installer grants standard users write access to one or more directories that RM3ConfigTool.exe searches at runtime for a required DLL, enabling the classic DLL planting technique. No public exploit code has been identified at the time of analysis, and this CVE does not appear in the CISA KEV catalog. | HIGH | 7.0 | 0.1% | 35 |
No patch
|
| CVE-2026-9634 | Privilege escalation in Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe) enables a local standard user to execute arbitrary code with Administrator or SYSTEM privileges via DLL search order hijacking. The tool searches system PATH directories for required DLLs, and one or more of those directories have incorrect default permissions allowing write access by non-privileged accounts; if a malicious DLL is planted there before an administrator runs the tool, it loads into the elevated process. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the underlying technique is well-understood and commonly leveraged in post-exploitation privilege escalation chains. | HIGH | 7.0 | 0.1% | 35 |
No patch
|
| CVE-2026-19471 | Stored cross-site scripting vulnerabilities in Rockwell Automation's ArmorStart® LT distributed motor controller expose industrial operators to persistent script injection via the device's embedded web management interface. Per the CVSS 4.0 AV:N/PR:N vector, unauthenticated remote attackers can inject malicious scripts that are persisted on the device and execute in the browsers of any operator or engineer who subsequently accesses affected pages - enabling session hijacking, credential theft, or display of falsified operational data. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the ICS context meaningfully elevates practical risk beyond the moderate base score. | MEDIUM | 6.9 | 0.3% | 34 |
No patch
|
| CVE-2026-12661 | Denial-of-service vulnerability in Rockwell Automation FactoryTalk® Historian Machine Edition allows a network-adjacent, high-privilege authenticated attacker to crash the device by sending crafted requests to its web interface, triggering a stack-based buffer overflow (CWE-121) that renders the historian unresponsive. All versions appear affected per the CPE wildcard, and the impact is limited to availability - no confidentiality or integrity compromise is possible. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis. | MEDIUM | 4.8 | 0.1% | 24 |
No patch
|