Source context: this article examines information published by the source on September 01, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What the vulnerability is
A denial of service vulnerability, identified as CVE-2021-42260, has been reported in multiple lines of Rockwell Automation programmable logic controllers (PLCs). The flaw is categorized as a loop with an unreachable exit condition (CWE-835), which can be triggered by the delivery of corrupt crafted data to the device.
If successfully triggered, this vulnerability results in a major nonrecoverable fault (MNRF). This state halts the controller’s operation, directly impacting the availability of the physical process it manages. Recovery procedures differ based on the hardware type: safety controllers require a full program download to resume operation, while non-safety controllers require a stage 2 reset.
Exposure and applicability
This vulnerability affects specific versions of the following product families:
* ControlLogix 5580
* GuardLogix 5580
* CompactLogix 5380
* Compact GuardLogix 5380
* CompactLogix 5480
Asset owners should check their current firmware levels. The vulnerability is applicable to devices running versions earlier than:
* 34.015
* 35.014
* 36.013
* 37.011
As of September 1, 2026, there have been no reports of public exploitation of this vulnerability provided to CISA.
Remediation priorities
Our analysis suggests that remediation should be prioritized based on the criticality of the process and the recovery time objective (RTO) for the affected controller. Because safety controllers require a program download—a more intensive process than a stage 2 reset—they may represent a higher operational risk during a fault event.
Primary Remediation:
Update firmware to the corrected versions provided by Rockwell Automation: 34.015, 35.014, 36.013, or 37.011, depending on the current firmware branch in use.
Compensating Controls:
For environments where immediate patching is not feasible due to production schedules, we recommend focusing on network isolation to prevent the delivery of crafted data:
* Ensure PLC management interfaces are not accessible from the internet.
* Isolate industrial control networks from business (enterprise) networks using firewalls.
* Restrict remote access to these devices via secure methods, such as updated Virtual Private Networks (VPNs).
How to validate remediation
Validation should be conducted through a combination of version verification and architectural review:
1. Firmware Audit: Confirm that the installed firmware version on each affected PLC matches or exceeds the corrected versions listed above. Note that a version check confirms the patch is present but does not guarantee total security against other unknown vectors.
2. Network Path Analysis: Verify that firewall rules and network segmentation effectively block unauthorized traffic from reaching the PLCs, reducing the likelihood of an external actor delivering crafted data.
All firmware updates should be performed according to OEM guidance, following a full risk assessment and within a planned maintenance window to avoid unplanned downtime.
Limits and open questions
While firmware updates address the specific loop condition identified in CVE-2021-42260, they do not eliminate all risks associated with network-borne attacks. Residual risk remains if an attacker gains internal access to the OT network through other compromised assets. Additionally, the source does not specify the exact nature of the “corrupt crafted data” required to trigger the fault, which limits the ability to create specific IDS signatures without further technical detail from the vendor.
Source and editorial note
Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix · Source date: September 01, 2026 · Retrieved September 01, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗