Rockwell Patches Over a Dozen Flaws in ControlLogix and CompactLogix

Detail

The patch cycle underscores a broader industrial trend , as PLCs and smart drives become more connected, their firmware and configuration tools are emerging as the weakest link in critical manufacturing networks. Vulnerability management is no longer an IT-only discipline; it is now a core procurement criterion for controllers, drives, and I/O systems.

Rockwell Automation's latest security bulletin covers a broad attack surface. The most consequential issue sits at the controller level, but the advisory also reaches engineering workstations through configuration and firmware tools that run with elevated privileges.

The spread of vulnerabilities across both controllers and workstation-side utilities (RSLinx Classic, ControlFLASH) is a pattern worth watching. Attackers increasingly chain a low-level workstation compromise into lateral movement toward PLC logic, making patching both the device and the engineering toolchain essential.

At the heart of the bulletin is CVE-2026-9637, a high-severity denial-of-service condition affecting the Logix platform. The flaw stems from improper validation of input length during CIP message processing, which can force a controller into a major nonrecoverable fault (MNRF).

Improper input validation during Common Industrial Protocol (CIP) message processing.

A crafted packet can trigger a major nonrecoverable fault (MNRF), halting control logic until the device is power-cycled.

Manual power cycle , meaning an attacker who reaches the controller can force extended process downtime.