Rockwell Automation Logix Platform Denial-of-Service Vulnerabilities

Rockwell Automation has issued an advisory regarding a denial-of-service vulnerability affecting its Logix Platform family of industrial control system controllers. The vulnerability, tracked as CVE-2026-9637, carries a CVSS v3 base score of 7.5 and a CVSS v4 base score of 8.7, both rated HIGH.

The flaw exists due to improper validation of input length during CIP (Common Industrial Protocol) message processing. Exploitation can trigger a major nonrecoverable fault (MNRF), causing the affected controller to enter a fault state that requires a power cycle to recover. The vulnerability impacts the following product lines and firmware versions:
- ControlLogix 5580: versions <= V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012
- CompactLogix 5380: versions <= V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012
- GuardLogix 5580: versions <= V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012
- Compact GuardLogix 5380: versions <= V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012

Rockwell Automation has released corrected firmware versions: V37.011, 34.015, 35.014, and 36.013, depending on the current platform version. The vendor advises users unable to upgrade immediately to follow security best practices, including network segmentation and minimizing exposure.

CISA has published the advisory (ICSA-26-244-03) and recommends that organizations minimize network exposure for control system devices, ensure they are not internet-accessible, and place control system networks behind firewalls isolated from business networks. When remote access is required, the use of VPNs is advised, with the caveat that VPN security depends on connected devices. No confirmed active exploitation in the wild has been reported at the time of the advisory.