Source context: this article examines information published by the source on September 01, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What the vulnerability is
CVE-2026-9637 is a denial-of-service (DoS) vulnerability affecting several Rockwell Automation Logix platform controllers. The flaw stems from improper validation of input length during the processing of Common Industrial Protocol (CIP) messages (CWE-119).
If exploited, this vulnerability can cause a major nonrecoverable fault (MNRF) in the affected controller. Because the fault is nonrecoverable via software commands, restoring the PLC to an operational state requires a physical power cycle of the hardware.
Exposure and applicability
This vulnerability applies specifically to the following product families and firmware versions:
- ControlLogix 5580: Versions $\le$V33, V34.011–V34.014, V35.011–V35.013, and V36.011–V36.012.
- CompactLogix 5380: Versions $\le$V33, V34.011–V34.014, V35.011–V35.013, and V36.011–V36.012.
- GuardLogix 5580: Versions $\le$V33, V34.011–V34.014, V35.011–V35.013, and V36.011–V36.012.
- Compact GuardLogix 5380: Versions $\le$V33, V34.011–V34.014, V35.011–V35.013, and V36.011–V36.012.
As of September 01, 2026, there are no known reports of public exploitation of this vulnerability.
Remediation priorities
Our analysis suggests that remediation should be prioritized based on the criticality of the process controlled by the PLC and the accessibility of the device network.
Primary Remediation: Firmware Updates
To address the root cause, Rockwell Automation recommends updating to the following firmware versions:
* V37.011
* 36.013
* 35.014
* 34.015
Secondary Remediation: Network Defense-in-Depth
For environments where immediate firmware updates are not feasible due to production schedules or validation requirements, we recommend the following defensive measures to reduce the likelihood of exposure:
* Network Isolation: Ensure control system networks are isolated from business networks using industrial firewalls.
* Internet Exposure: Verify that no PLCs are directly accessible from the internet.
* Secure Remote Access: If remote access is required, utilize secure methods such as updated Virtual Private Networks (VPNs).
How to validate remediation
Asset owners should verify the current firmware version of all 5580 and 5380 series controllers against the affected list. A successful update to one of the recommended versions (V37.011, 36.013, 35.014, or 34.015) indicates that the specific input validation flaw has been addressed.
For network-based mitigations, operators can validate effectiveness by reviewing firewall rules and access control lists (ACLs) to ensure only authorized engineering workstations and HMIs can communicate with the PLCs via CIP.
Limits and open questions
While firmware updates address the vulnerability in the Logix platform, they do not eliminate risks associated with other network-level weaknesses or vulnerabilities in adjacent hardware. Furthermore, because recovery from a major nonrecoverable fault requires a physical power cycle, organizations should evaluate their physical access controls and incident response timelines for onsite personnel to perform such resets if a fault occurs.
Source and editorial note
Rockwell Automation Logix Platform · Source date: September 01, 2026 · Retrieved September 01, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗