4,400 Rockwell PLCs Still Exposed Online Despite Federal Warnings

Why it matters now: A sweeping internet scan by Forescout Vedere Labs has identified 4,407 Rockwell Automation programmable logic controllers (PLCs) sitting directly on the public internet — including 22 devices in cities recently targeted by water-system cyberattacks. The findings, published August 3, 2026, arrive just days after the FBI and EPA issued an urgent joint advisory confirming that malicious actors are actively exploiting these same controllers, causing real-world physical consequences including water pressure loss and flooding across at least seven U.S. states.

The Scale of Exposure: 4,407 Controllers, One Protocol

Forescout's scan targeted TCP port 44818 — the EtherNet/IP engineering protocol used by Rockwell Automation's Allen-Bradley PLC family. Of the 4,407 exposed devices detected worldwide, 2,844 were located in the United States. The research specifically identified MicroLogix 1100 and 1400 series controllers — the very models named in the FBI-EPA advisory — openly reachable without VPNs, firewalls, or access control lists.

"These devices aren't hidden behind layers of obfuscation," researchers noted. "They are trivially discoverable using the same internet-wide scanning techniques available to any threat actor." The scan did not attempt to confirm whether the exposed controllers were compromised, but the mere presence of these devices on the open internet violates every fundamental OT security principle.

No Sophistication Required: The Anatomy of an Entry-Level Attack

What makes this threat particularly alarming is its startling simplicity. According to the FBI advisory, attackers required no zero-day exploits, no malware payloads, and no social engineering. A network connection and basic knowledge of industrial protocol commands were sufficient to remotely access controllers, change IP addresses, and set passwords — effectively locking legitimate operators out of their own equipment.

In at least one documented case, the attack severed a water utility's ability to monitor and control its own infrastructure. The result: uncontrolled pressure fluctuations and localized flooding. The advisory explicitly stated these were not theoretical risks — the attacks caused "operational disruption and financial loss" across multiple critical infrastructure sectors.

"We are not looking at a Stuxnet-level operation," one OT security researcher told CyberScoop. "This is the equivalent of leaving your front door wide open and being surprised someone walked in."

The End-of-Life Problem: MicroLogix 1100 and the Patching Dead End

Compounding the exposure crisis is a hardware lifecycle issue. The MicroLogix 1100 — one of the two models explicitly targeted — has been discontinued by Rockwell Automation. These end-of-life controllers cannot receive firmware updates for newly discovered vulnerabilities, yet thousands remain in active service across water treatment plants, agricultural facilities, and manufacturing floors nationwide.

Rockwell Automation itself acknowledged the severity in an updated security advisory, stating that threat actors have been "remotely tampering with device configurations by changing IP addresses and turning on and setting passwords where no passwords were previously set." The company's mitigation guidance is unambiguous: remove these devices from direct internet exposure entirely.

From Unitronics to Rockwell: A Widening Threat Landscape

The current wave of attacks echoes the 2023–2024 campaign against Unitronics PLCs, when Iranian-affiliated group CyberAv3ngers — linked to the Islamic Revolutionary Guard Corps (IRGC) — compromised hundreds of U.S. water systems by exploiting internet-exposed controllers. That campaign targeted Israeli-made Unitronics hardware. The shift to Rockwell Automation's Allen-Bradley line represents an expansion of the adversary's target set, not a change in tactics.

In April 2026, six U.S. federal agencies — including the FBI, CISA, NSA, and EPA — issued a joint advisory (AA26-097A) warning that Iranian-affiliated APT actors had moved beyond Rockwell to also target Schneider Electric and Siemens PLCs. The advisory, updated on July 22, confirmed that attackers were using leased third-party infrastructure and manufacturers' own programming software to connect to misconfigured devices.

Federal Guidance: Disconnect, Segment, Authenticate

The FBI-EPA advisory outlines clear, actionable protective measures for asset owners. The cornerstone recommendation: disconnect PLCs from the public-facing internet immediately. Where remote access is operationally necessary, the agencies direct utilities to implement secure gateways with jump hosts that broker connections — eliminating any scenario where an OT device is directly reachable from the open internet.

Additional measures include changing all default passwords, deploying access control lists (ACLs) to restrict communication to authorized devices only, setting physical PLC mode switches to "Run" to prevent unauthorized programming changes, and maintaining manual operation capability as a fail-safe. For end-of-life hardware, the guidance is blunt: plan for replacement.

What Comes Next: The Regulatory Horizon

The persistent exposure of thousands of industrial controllers will almost certainly accelerate regulatory action. The EPA has already signaled its intent to strengthen cybersecurity requirements for water and wastewater systems, and the Cybersecurity and Infrastructure Security Agency (CISA) is expected to expand its Known Exploited Vulnerabilities (KEV) catalog to include more OT-specific flaws. In 2025, CISA added 242 vulnerabilities to the KEV catalog — a 30 percent year-over-year increase — while Forescout's own KEV list grew by 213 percent.

For the industrial automation sector, the exposure crisis underscores a structural tension: the equipment lifetimes measured in decades versus the threat timelines measured in hours. The 4,407 exposed controllers are not a technical anomaly. They are a visible symptom of an industry that has prioritized uptime and accessibility over security fundamentals — and the bill is now coming due.