Rockwell Automation Logix Platform

1. Executive summary

On 2026-09-01 CISA published advisory ICSA-26-244-03, republishing a Rockwell Automation advisory covering CVE-2026-9637, a network-reachable denial-of-service vulnerability in the Logix control platform (ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380). The flaw — improper validation of input length during CIP message processing (CWE-119) — allows an unauthenticated attacker to drive affected controllers into a major nonrecoverable fault (MNRF) requiring a physical power cycle to restore. CVSS v3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); CVSS v4.0 8.7 HIGH. No known public exploitation has been reported to CISA at this time, and the vulnerability is not listed as known-exploited. For EMEA financial services, direct exposure is limited to firms operating Rockwell-based OT in facilities, data-centre infrastructure or physical security/building systems; the risk is availability loss of control processes, not data compromise.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The vulnerability is a vendor-published patch advisory with no reported exploitation, no incident, and no confirmed financial-sector impact; a generic "patching is required" trigger would apply to virtually every advisory and is not a distinctive engagement of any article in the regulatory reference. Firms that do operate affected controllers within in-scope ICT-supported critical functions should nonetheless handle this through their existing ICT risk and patch-management processes.

3. Technical analysis & attack chain

Vulnerability: CVE-2026-9637 — improper validation of input length during CIP (Common Industrial Protocol) message processing, classified as CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer.

CVSS (per CISA advisory, authoritative)

v3.1: 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
v4.0: 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

The vector set is availability-only: no confidentiality or integrity impact. This is a fault-induction flaw, not an RCE or data-exposure primitive.

Confirmed attack chain (as described in the advisory)

Network reachability. The attacker must be able to deliver CIP traffic to an affected controller. CIP is carried over EtherNet/IP (TCP/44818 and UDP/2222 in typical Rockwell deployments; the advisory itself does not specify ports). No authentication, privileges or user interaction are required (PR:N, UI:N).
Malformed CIP message. The attacker sends a CIP message whose input length is improperly validated by the controller firmware's message-processing path.
Major nonrecoverable fault (MNRF). The out-of-bounds memory operation drives the controller into an MNRF state.
Recovery requires physical intervention. Restoration requires a power cycle of the controller. There is no remote or automatic recovery path described.

Affected products and versions (per CISA)

ControlLogix 5580: ≤V33, V34.011–V34.014, V35.011–V35.013, V36.011–V36.012
CompactLogix 5380: same version ranges
GuardLogix 5580: same version ranges
Compact GuardLogix 5380: same version ranges

Vendor fixes (per CISA): update to firmware V34.015, V35.014, V36.013, or V37.011 (the corrected release for each affected train).

Context from related advisories in the same Rockwell cycle (corroborating the pattern, not the same CVE): CISA simultaneously published ICSA-26-244-05, a CWE-835 infinite-loop DoS in ControlLogix/CompactLogix/CompactLogix 5480/GuardLogix/Compact GuardLogix triggered by corrupt crafted data, also resulting in MNRF (recovery: program download for safety controllers, stage 2 reset for non-safety), with identical CVSS 7.5/8.7 and the same corrected firmware trains (34.015, 35.014, 36.013, 37.011). Earlier advisories in the corpus — ICSA-26-197-06 (CWE-120 buffer overflow, MNRF via invalid project load or invalid file data, CVSS 8.6/9.2) and ICSA-26-244-01 (RSLinx Classic CIP packet handling, CVSS 8.6/9.2) — show sustained CIP-handling weaknesses across the Logix ecosystem. Treat this as a platform-wide hardening signal, not an isolated bug.

Caveats: No exploit code, proof-of-concept, attacker tooling, or threat-actor attribution is present in any source. CISA states no known public exploitation targeting this vulnerability has been reported. The specific CIP service code or message structure that triggers the fault is not disclosed; detection therefore cannot key on a specific malformed packet signature from this advisory alone.

4. Mitigation & containment

P1 — within 24 hours

Inventory and exposure check. Identify all ControlLogix 5580, CompactLogix 5380, GuardLogix 5580 and Compact GuardLogix 5380 controllers in estate (including building management, physical security, print/mail facilities and data-centre OT). Confirm firmware versions against the affected ranges above.
Verify network isolation. Confirm no affected controller is reachable from the internet or from general business networks. CISA's standing guidance: locate control system networks behind firewalls, isolated from business networks; where remote access is required, use an up-to-date VPN — recognising a VPN is only as secure as the connected devices.
Restrict CIP reachability at the firewall/ACL layer. Permit EtherNet/IP CIP traffic to controllers only from named engineering workstations and HMAs. This is the primary containment lever given the unauthenticated, network-reachable vector.

P2 — within 72 hours

Plan firmware updates to V34.015, V35.014, V36.013 or V37.011 per train. Schedule against change-control windows appropriate to controller downtime; note that the update itself requires controlled controller restarts.
Where immediate upgrade is not feasible, apply Rockwell Automation's security best practices (vendor reference: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US) as compensating controls, and document the exception.
Confirm recovery procedures. Because exploitation requires a physical power cycle to recover, verify that site staff know the MNRF recovery procedure and that spares/recovery images are staged for safety-critical and high-availability installations.

P3 — within 7 days

Complete firmware remediation across all affected controllers, prioritising internet-adjacent or business-network-adjacent units.
Add CIP anomaly monitoring on OT network segments (see §6) and baseline normal CIP traffic so unexpected sources are flagged.
Review the related Rockwell advisories in §7 — ICSA-26-244-05 (infinite-loop DoS, same firmware fixes), ICSA-26-197-06 (buffer overflow, MNRF via invalid project/file writes) and ICSA-26-244-01 (RSLinx Classic 4.60 fix) — and fold their remediations into the same change window where the same controllers are in scope.

5. Indicators of compromise

No indicators of compromise available in the source material. The advisory describes a vulnerability, not an intrusion; no hashes, domains, IPs or artefacts are provided.

Behavioural indicators

Behaviour	Where to observe	Confidence
Controller enters major nonrecoverable fault (MNRF) absent a legitimate program download or power event	Controller status/LED, RSLogix/Studio 5000 connection logs, site operations logs	High (advisory-confirmed impact)
CIP/EtherNet/IP traffic to controllers from hosts outside the authorised engineering workstation set	OT-segment network monitoring, firewall logs on EtherNet/IP ports	Medium (defensive inference from AV:N/PR:N vector, not an observed attack signature)

6. Detection

The sources contain no threat artefacts — no strings, filenames, hashes, command lines or specific malformed-packet signatures — so a YARA rule is not supportable. The only defensible detection content is behavioural, at the network layer:

title: Rockwell Logix Controller Unexpected CIP Peer
id: 7d1f3a44-2b6e-4c19-9f0a-8e5c1d2b7066
status: experimental
description: >
  Detects EtherNet/IP CIP session traffic to Rockwell Logix controllers from
  sources outside the authorised engineering workstation allowlist. Supports
  detection of exploitation attempts against CVE-2026-9637 (unauthenticated
  network DoS via malformed CIP message, ICSA-26-244-03) and related CIP
  handling flaws in the same advisory cycle.
references:

  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-03
author: Adverse Trace
date: 2026-09-01
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    destination_port:

      - 44818
      - 2222
  filter_authorized:
    src_ip: '<authorised engineering workstation range/CIDR>'
  condition: selection and not filter_authorized
falsepositives:

  - Legitimate HMIs, SCADA servers or newly commissioned engineering hosts not yet in the allowlist
level: medium

Note: the port values reflect standard EtherNet/IP usage; the CISA advisory does not itself specify ports. Tune the allowlist to the actual OT environment before enforcement.

7. Sources

CISA, Rockwell Automation Logix Platform (ICSA-26-244-03), https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-03, 2026-09-01
CISA, Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix (ICSA-26-244-05), https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-05, 2026-09-01
CISA, Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix (ICSA-26-197-06), https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-06
CISA, Rockwell Automation RSLinx Classic (ICSA-26-244-01), https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-01
CISA, Rockwell Automation RSLinx (ICSA-26-167-02), https://www.cisa.gov/news-events/ics-advisories/icsa-26-167-02, 2026-06-16
CISA, Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module (ICSA-26-211-05), https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-05, 2026-07-30
CISA, Rockwell Automation FactoryTalk Analytics PavilionX (ICSA-26-167-01), https://www.cisa.gov/news-events/ics-advisories/icsa-26-167-01, 2026-06-16

8. Adverse Trace position

CVE-2026-9637 is a HIGH-severity (CVSS v3.1 7.5 / v4.0 8.7), unauthenticated, network-reachable availability-only flaw: it cannot be used for code execution or data theft, but a single malformed CIP message takes a controller down hard, with recovery requiring a physical power cycle — an attractive, low-cost disruption primitive for anyone who has already obtained OT network access. There is no evidence of exploitation and no CISA KEV listing, so we assess the immediate risk to EMEA financial services as low-to-moderate and concentrated in firms with Rockwell-based OT (facilities, building management, physical security, data-centre infrastructure); the exposure question — not the patch — is the urgent item, and any controller reachable from business networks should be treated as a priority. The parallel ICSA-26-244-05 advisory with the same firmware fixes makes this an efficient single-change-window remediation. We will monitor for KEV listing, proof-of-concept publication, or any reporting of active exploitation, and will reissue if the exploitation picture changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.