Denial-of-Service Vulnerabilities in Rockwell Automation Logix Platforms
Article Content
- •CVE-2026-9637 and CVE-2021-42260 affect multiple Rockwell Automation Logix platforms.
- •Denial-of-service vulnerabilities can cause major nonrecoverable faults (MNRF).
- •Users are urged to upgrade firmware to versions 34.015 and later for mitigation.
On September 1, 2026, CISA published advisories regarding denial-of-service vulnerabilities in Rockwell Automation's Logix platforms, specifically affecting ControlLogix and CompactLogix systems. The vulnerabilities, identified as CVE-2026-9637 and CVE-2021-42260, can be triggered by corrupt crafted data or improper input length validation during message processing. Affected versions include ControlLogix 5580 and CompactLogix 5380 with firmware versions below 34.015 and 35.014, respectively. The vulnerabilities could lead to major nonrecoverable faults (MNRF), necessitating either a program download or a power cycle for recovery. Rockwell Automation recommends users upgrade to the latest firmware versions to mitigate the risks. CISA advises implementing security best practices to minimize network exposure and enhance system security. The vulnerabilities are applicable worldwide and impact critical manufacturing sectors.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2021-42260 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Korean-speaking Hackers Target PHP Vulnerabilities in Global Campaign A cybersecurity report from Cyfirma reveals that attackers, possibly linked to North Korea's Lazarus group, are preparing to exploit critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities allow unauthenticated remote code execution, posing a significant threat to government…