This vulnerability (CVE-2026-11317) involves improper resource shutdown or release (CWE-404) in Rockwell Automation CompactLogix and ControlLogix products. When a crafted CIP message is sent to the affected devices, it can trigger a fault leading to a denial of service condition. The fault is more likely on devices with less memory, resulting in a major nonrecoverable fault (MNRF) that necessitates a program download for recovery. The CVSS 4.0 base score is 8.7, indicating high severity. No vendor advisory or patch information is currently available.

Exploitation of this vulnerability can cause affected devices to enter a major nonrecoverable fault state, effectively causing a denial of service. Recovery requires a program download, which may lead to operational downtime. The vulnerability does not require privileges, user interaction, or authentication, and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should monitor for unusual CIP message traffic and consider network-level controls to restrict access to affected devices. No official fix or temporary workaround has been published by the vendor at this time.