Vulnerabilities
Rockwell Automation Logix Platforms Hit by CVE-2026-9637 Denial‑of‑Service Exploit
A critical denial‑of‑service flaw (CVE‑2026‑9637) has been uncovered in Rockwell Automation’s Logix family of controllers. The bug stems from improper input‑length validation in CIP message handling, allowing an attacker to trigger a non‑recoverable fault that forces a power cycle. The issue spans ControlLogix, CompactLogix, GuardLogix and Compact GuardLogix models up to firmware V36.012, with a CVSS score of 7.5. Rockwell recommends flashing the latest firmware (V37.011 for ControlLogix, V34.015 for CompactLogix, V37.011 for GuardLogix, V34.015 for Compact GuardLogix) to mitigate the risk.
Industrial control systems are no longer immune to classic denial‑of‑service attacks. A new vulnerability, CVE‑2026‑9637, has been identified in Rockwell Automation’s Logix platform family. The flaw lies in the Common Industrial Protocol (CIP) message parser, which fails to correctly validate the length of incoming data. An attacker can exploit this oversight to send malformed packets that crash the controller, forcing a hard reset and causing a major non‑recoverable fault (MNRF).
Affected Products
- ControlLogix 5580 – firmware versions V33 and earlier, V34.011–V34.014, V35.011–V35.013, V36.011–V36.012
- CompactLogix 5380 – firmware versions V33 and earlier, V34.011–V34.014, V35.011–V35.013, V36.011–V36.012
- GuardLogix 5580 – firmware versions V33 and earlier, V34.011–V34.014, V35.011–V35.013, V36.011–V36.012
- Compact GuardLogix 5380 – firmware versions V33 and earlier, V34.011–V34.014, V35.011–V35.013, V36.011–V36.012
Impact
The vulnerability can be leveraged to bring an entire control system down, disrupting production lines and potentially compromising safety. The CVSS score of 7.5 reflects the severity of the denial‑of‑service potential and the difficulty of mitigating without a firmware update.
Remediation
Rockwell Automation advises all impacted units to upgrade to the latest firmware releases:
- ControlLogix: V37.011
- CompactLogix: V34.015
- GuardLogix: V37.011
- Compact GuardLogix: V34.015
Updating firmware is the only effective countermeasure. Operators should verify that the new firmware version is correctly installed and that CIP message handling behaves as expected.
Next Steps for Operators
- Audit all Logix controllers to confirm firmware versions.
- Schedule firmware upgrades during planned maintenance windows.
- Validate post‑upgrade stability through CIP traffic monitoring.
- Implement network segmentation to limit potential attack vectors.
Related vulnerabilities
StrongSwan Remote DoS Vulnerability (CVE‑2026‑78123) – Immediate Patching Required
A critical remote denial‑of‑service flaw has been discovered in StrongSwan VPN software, identified as CVE‑2026‑78123. The vulnerability allows attackers to crash the daemon on any system running a version older than 6.1.0, potentially taking networks offline. It is triggered by malformed IKE packets and can be mitigated by applying the vendor‑released patch. All affected deployments should update immediately.
Read briefing
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
Cisco ASA/FTD DTLS DoS Vulnerability (CVE‑2026‑20250) – Immediate Patch Required
Cisco’s Adaptive Security Appliance (ASA) and Threat Defense (FTD) software for the 3100 and 4200 series can be forced into a denial‑of‑service state by an unauthenticated attacker sending crafted DTLS traffic. The flaw stems from improper resource handling during DTLS message processing, causing a device reload. Cisco has issued patches and workarounds; applying the update is essential to keep firewalls online.
Read briefing
Cisco IOS/IOS XE XMCP Denial‑of‑Service Vulnerability (CVE‑2026‑20301) – Unauthenticated Remote Exploit
Cisco has identified a high‑impact flaw in the Extensible Messaging Client Protocol (XMCP) on its IOS and IOS XE platforms. Attackers can send malformed XMCP packets to trigger an unexpected device reload, causing a denial‑of‑service without any authentication. The issue stems from improper packet parsing, and no workaround exists—only a patch. Network operators must apply the latest updates immediately to safeguard their infrastructure.
Read briefing