Source context: this article examines information published by the source on September 01, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What the vulnerability is
Rockwell Automation has identified four security vulnerabilities in RSLinx Classic that could lead to a denial-of-service (DoS) condition. These flaws—CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, and CVE-2026-9625—stem from improper handling of Common Industrial Protocol (CIP) packets. Specifically, the vulnerabilities involve integer overflows/underflows and classic buffer overflows.
An attacker could send crafted CIP packets over the network to trigger these conditions. The operational result is a crash of the RSLinx Classic service, which requires a manual restart of the service to restore functionality. As of September 1, 2026, there have been no reports of public exploitation of these vulnerabilities.
Exposure and applicability
These vulnerabilities affect Rockwell Automation RSLinx Classic versions 4.50 and all prior versions. Because RSLinx Classic is frequently used as the communication bridge between engineering workstations or HMIs and PLCs, a service crash could disrupt the ability of operators to monitor or control physical processes from those stations.
The attack vector is network-based, meaning any device capable of sending CIP packets to the host running the affected software is a potential source of risk. This makes the security of the industrial network perimeter critical for mitigating exposure.
Remediation priorities
Our analysis suggests the following prioritized actions for asset owners and OT security leaders:
- Update Software: The primary remediation is to upgrade RSLinx Classic to version 4.60, which contains the vendor’s corrections for all four CVEs. This should be scheduled during a maintenance window according to site-specific change control procedures.
- Network Segmentation: For environments where immediate patching is not feasible, we recommend ensuring that systems running RSLinx Classic are isolated from business networks and the internet via industrial firewalls. This limits the ability of an attacker to deliver the crafted CIP packets required to trigger the crash.
- Secure Remote Access: If remote access to the OT environment is necessary, it should be restricted to secure methods such as updated Virtual Private Networks (VPNs) to prevent unauthorized network-level access to the communication software.
- Implement Vendor Best Practices: Users unable to upgrade immediately should review and apply Rockwell Automation’s established security best practices for their industrial environment.
How to validate remediation
To verify that exposure has been reduced, administrators should perform a version check on all workstations running RSLinx Classic to confirm the installation of version 4.60.
Additionally, network engineers can validate segmentation by reviewing firewall rules to ensure that only authorized devices and protocols are permitted to communicate with the hosts running RSLinx. We do not recommend active scanning or sending crafted packets to production equipment to test these vulnerabilities, as this could inadvertently trigger the denial-of-service condition.
Limits and open questions
While updating to version 4.60 addresses these specific flaws, it does not eliminate all risks associated with network-based attacks on OT software. Residual risk remains if the underlying network architecture allows unrestricted lateral movement.
Furthermore, while the vendor has provided a fix, the specific operational impact of a RSLinx service crash varies by site; owners must conduct their own impact analysis to determine how a loss of communication between the PC and the PLC affects their specific physical process safety and availability.
Source and editorial note
Rockwell Automation RSLinx Classic · Source date: September 01, 2026 · Retrieved September 01, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗