Rockwell Automation vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-12656 A denial-of-service security issue exists in the affected product and version.High 8.7 · Oct 13, 2026
• CVE-2026-12655 A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials.High 8.8 · Oct 13, 2026
• CVE-2026-6071 A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allHigh 7.5 · Sep 3, 2026
• CVE-2024-7956 A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects.High 7.6 · Sep 2, 2026
• CVE-2024-7953 A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it.High 8.7 · Sep 1, 2026
• CVE-2024-7952 A data exposure vulnerability exists in the affected product.High 8.7 · Sep 1, 2026
• CVE-2026-9637 A denial-of-service security issue exists in the affected Logix platforms listed in the table above.High 8.7 · Sep 1, 2026
• CVE-2026-9634 A security issue exists within the Redundancy Module Configuration Tool.High 7 · Sep 1, 2026
• CVE-2026-9633 A security issue exists within the Redundancy Module Configuration Tool.High 7 · Sep 1, 2026
• CVE-2026-9625 A denial-of-service security issue exists within RSLinx® Classic.High 8.7 · Sep 1, 2026
• CVE-2026-9624 A denial-of-service security issue exists within RSLinx® Classic.High 8.7 · Sep 1, 2026
• CVE-2026-9622 A denial-of-service security issue exists within RSLinx® Classic.High 8.7 · Sep 1, 2026
• CVE-2026-9621 A denial-of-service security issue exists within RSLinx® Classic.Critical 9.2 · Sep 1, 2026
• CVE-2026-16675 A privilege escalation security issue exists within FactoryTalk® Activation Manager.High 8.5 · Sep 1, 2026
• CVE-2026-12663 A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory.High 7 · Sep 1, 2026
• CVE-2025-12768 A security issue exists within FactoryTalk® Historian Machine Edition.High 8.6 · Sep 1, 2026
• CVE-2026-84235 A denial-of-service security issue exists in the affected product.High 8.7 · Sep 1, 2026
• CVE-2026-19472 A denial-of-service security issue exists within ArmorStart® LT.High 8.7 · Sep 1, 2026
• CVE-2026-9636 A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling.High 8.2 · Jul 14, 2026
• CVE-2026-9292 A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud.High 8.4 · Jul 14, 2026
• CVE-2026-9128 A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration.High 7.3 · Jul 14, 2026
• CVE-2026-9127 A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file.High 7.3 · Jul 14, 2026
• CVE-2026-12659 A denial-of-service security issue exists in the affected products.High 8.7 · Jul 14, 2026
• CVE-2026-11917 A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API.High 7.2 · Jul 14, 2026
• CVE-2025-11698 A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072.Critical 9.2 · Jul 14, 2026