29
CVEs
4
Critical
20
High
0
KEV
0
PoC
24
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
20
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (26)
Rslinx Classic
4
Studio 5000 Logix Designer
3
Armorstart Lt
2
Compactlogix 5370
2
Compactlogix 5370 Compact Guardlogix 5370 Controllogix 5570 Guardlogix 5570
2
Redundancy Module Configuration Tool
2
Flex I O Ethernet Ip Adapters
2
Factorytalk Historian Machine Edition
2
Factorytalk Services Platform
1
Controllogix 5580 Compactlogix 5380 Guardlogix 5580 Compact Guardlogix 5380 1756 En4Tr
1
Factorytalk Activation Manager
1
The Flex 5000 Ethernet Ip Adapter
1
Factorytalk Datamosaix Private Cloud
1
Arena
1
Factorytalk Analytics Pavilionx
1
1756 En2 1756 En3
1
Otto Fleet Manager
1
Compactlogix Controllogix
1
Factorytalk Historian Se
1
Controlflash
1
Compactlogix 5380 Controllogix 5580
1
Factorytalk Thinmanager
1
1756 Enbt
1
1718 Aentr 1719 Aentr
1
1734 Point I O
1
Compactlogix 5380 Recovery Image Compact Guardlogix 5380 Recovery Image Compactlogix 5480 Recovery Image Controllogix 5580 Recovery Image Guardlogix 5580 Recovery Image
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-9127 | Local authenticated code execution in Rockwell Automation Studio 5000 Logix Designer allows any low-privileged authenticated user to tamper with the incorrectly-protected external-tools configuration file (CWE-863) and redirect a configured tool path to a malicious executable. Because the payload runs when a different user later invokes the external tools feature, this is effectively a privilege-crossing RCE against the engineering workstation. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; exploitation is gated by high attack complexity, a specific attack requirement, and required victim interaction (CVSS 4.0 base 7.3). | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2026-9128 | Local arbitrary code execution in Rockwell Automation Studio 5000 Logix Designer arises because the External Tools configuration stores executable paths that contain spaces without quoting (CWE-428). A low-privileged local user who can write a malicious binary into an earlier segment of the resolved search path can have Windows execute it in place of the intended tool, running code with the privileges of the operator using the application. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 score is 7.3 (High), tempered by local access, high attack complexity, a present attack requirement, and required active user interaction. | HIGH | 7.3 | 0.1% | 47 |
No patch
|
| CVE-2025-12011 | Remote denial-of-service in Rockwell Automation CompactLogix 5370, Compact GuardLogix 5370, ControlLogix 5570, and GuardLogix 5570 controllers allows a remote user to push a malformed project file that forces the controller into a Major Non-Recoverable Fault (MNRF), halting the controlled process until manual recovery. The CVSS 4.0 score of 9.2 reflects high availability impact on both the controller and the downstream physical process (VA:H/SA:H) with no authentication or user interaction required per the vendor vector. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the loss of a safety-rated (GuardLogix) controller makes availability the dominant concern. | CRITICAL | 9.2 | 0.3% | 46 |
No patch
|
| CVE-2025-12012 | Denial-of-service in Rockwell Automation Logix programmable controllers allows a remote unauthenticated attacker to write invalid file data that forces the device into a Major Non-Recoverable Fault (MNRF), halting the industrial process it controls. Rated CVSS 4.0 9.2 (Critical) with availability as the sole impact, the flaw is a CWE-120 buffer overflow reachable over the network with no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low attack complexity makes it a high-priority patch for OT environments. | CRITICAL | 9.2 | 0.3% | 46 |
No patch
|
| CVE-2025-11698 | Denial-of-service in Rockwell Automation CompactLogix/GuardLogix 5380, CompactLogix 5480, and ControlLogix/GuardLogix 5580 controllers running boot firmware below version 1.072 lets a remote unauthenticated attacker write malformed file data that forces the device into a major non-recoverable fault (MNRF), halting the controlled process until manual recovery. The flaw carries a CVSS 4.0 base of 9.2 driven purely by availability impact (no data confidentiality or integrity loss) and requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.2 | 0.3% | 46 |
No patch
|
| CVE-2026-9621 | Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the RSLinx Classic service by sending a single crafted CIP (Common Industrial Protocol) packet, after which the service must be manually restarted to restore communications. The flaw is rooted in an integer-overflow (CWE-190) style mishandling of a malformed packet and carries a CVSS 4.0 base score of 9.2 driven by high availability impact on both the service and dependent systems. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.2 | 0.3% | 46 |
No patch
|
| CVE-2026-75112 | Weak bcrypt work factor in Rockwell Automation OTTO Fleet Manager exposes stored password hashes to accelerated offline brute-force attacks when an attacker gains access to an unencrypted system backup. All versions covered by CPE cpe:2.3:a:rockwell_automation:otto®_fleet_manager:* are affected. An adjacent-network attacker with low-level access who obtains a system backup could recover credentials more easily than a properly configured bcrypt implementation would permit, potentially enabling privilege escalation or lateral movement within the OT environment. No public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 6.9 | 0.1% | 45 |
No patch
|
| CVE-2026-10714 | Authentication bypass in Rockwell Automation FactoryTalk Services Platform (FTSP) lets an authenticated low-privilege user forge JWT tokens during Okta Web Authentication because the application fails to enforce the RSA signing algorithm, permitting the classic 'alg:none' attack. A successful attacker can impersonate any authorized user, reaching system configuration and granting permissions to other systems that FTSP protects. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the alg:none technique is well documented and trivially reproducible once access is obtained. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-9140 | Denial-of-service in the Rockwell Automation 1719-AENTR (and companion 1718-AENTR) EtherNet/IP adapter allows remote attackers to overload the device with a UDP unicast network storm, causing loss of communication that requires a manual power cycle to recover. The CVSS 4.0 score of 8.7 reflects a high availability impact reachable over the network with no privileges or user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the low attack complexity makes it a real operational-technology availability concern. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-9653 | Denial-of-service in Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT ControlLogix EtherNet/IP communication modules lets an unauthenticated network attacker drop active device connections by sending malformed CIP Implicit (I/O) Connection packets. Because CVSS 4.0 rates only availability impact (VC:N/VI:N/VA:H) and connections recover immediately once the traffic stops, the flaw enables repeatable disruption rather than persistent outage or code execution. No public exploit identified at time of analysis, and the module is not in CISA KEV. | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2026-12659 | Remote denial-of-service in the Rockwell Automation FLEX 5000 EtherNet/IP adapter allows an unauthenticated network attacker to crash the module by sending a crafted CIP (Common Industrial Protocol) packet, halting the adapter and its associated I/O until a manual power cycle restores operation. The CVSS 4.0 score of 8.7 (High) reflects a network-reachable, no-privilege attack with high availability impact but no confidentiality or integrity loss. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-19472 | Rockwell Automation's ArmorStart LT industrial motor control device contains a denial-of-service flaw in its embedded web server, exploitable by sending a crafted HTTP PUT request with no authentication or special preconditions. The root cause (CWE-770) is improper resource throttling during HTTP PUT processing, which causes the web server to become unavailable. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the unauthenticated network attack surface in an OT/ICS context makes this a material operational risk wherever the device's web interface is reachable. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-9637 | Unauthenticated remote denial-of-service in Rockwell Automation CompactLogix 5380 and ControlLogix 5580 industrial controllers allows a network-adjacent attacker to trigger a Major Nonrecoverable Fault (MNRF) by sending a malformed CIP message with an invalid input length, requiring a physical power cycle to restore controller operation. The vulnerability is rooted in CWE-119 (improper buffer bounds restriction) during CIP message processing on EtherNet/IP-accessible PLCs. No public exploit code or active exploitation has been identified at the time of this analysis, but the zero-prerequisite network attack surface on safety-critical industrial hardware makes this a prioritized remediation target for OT security teams. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-9622 | Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the RSLinx Classic communication service by sending a single crafted CIP packet targeting the Forward Close service. Because RSLinx Classic acts as the primary communication bridge between engineering workstations and Allen-Bradley PLCs, a crash forces a manual service restart and can halt production operations in industrial environments. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-9624 | Denial-of-service in Rockwell Automation RSLinx Classic allows unauthenticated remote attackers to crash the communication service by sending a specially crafted CIP packet with a manipulated data length field. The root cause is an integer underflow (CWE-191) in the packet length validation routine, causing the service to terminate and requiring a manual restart to recover. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the zero-barrier network attack vector against a critical ICS communication layer makes this a high-priority remediation target. | HIGH | 8.7 | 0.3% | 44 |
No patch
|