Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products

Rockwell Automation disclosed multiple vulnerabilities across its industrial automation product portfolio. The advisories cover critical and high-severity issues such as DoS vulnerabilities in RSLinx Classic communications software that can crash the service, a high-severity DoS flaw in ControlLogix and CompactLogix controllers (CVE-2026-9637) not confirmed exploited, a high-severity remote code execution flaw in FactoryTalk Historian Machine Edition, and a privilege escalation vulnerability in FactoryTalk Activation Manager. ArmorStart products have multiple XSS vulnerabilities and a DoS issue affecting the web server. ControlFLASH firmware management utility has a vulnerability allowing arbitrary code execution at the logged-in user's permission level. The Redundancy Module Configuration Tool is affected by a high-severity privilege escalation flaw. Rockwell Automation has provided patches or workarounds for these issues.

Successful exploitation of these vulnerabilities could result in denial-of-service conditions causing service crashes and restarts, remote code execution allowing attackers to run arbitrary code at the logged-in user's permission level, privilege escalation enabling attackers to access files, processes, and system resources with elevated privileges, and execution of malicious scripts via XSS vulnerabilities. These impacts affect industrial control systems and automation products, potentially disrupting industrial operations or compromising system integrity. However, there is no confirmed exploitation in the wild for these vulnerabilities as per Rockwell and CISA advisories.

Rockwell Automation has released patches and workarounds for all disclosed vulnerabilities. Users of affected products should apply the official patches or implement the provided workarounds promptly. Since the vendor has addressed these issues with official fixes, no additional immediate mitigation steps are required beyond applying these updates. Monitoring vendor advisories for any updates or further guidance is recommended.