Four high-severity memory corruption vulnerabilities (CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, CVE-2026-8314) in Rockwell Automation's Arena Simulation software allow out-of-bounds writes due to improper validation of user-supplied data. Successful exploitation enables arbitrary code execution within the context of the Arena process. The vulnerabilities affect Arena versions up to and including 17.00.00 and require user interaction to trigger via malicious Arena experiment or model files. Rockwell patched these issues in version 17.00.01. The vulnerabilities do not allow remote exploitation without user action, and no in-the-wild exploitation has been observed. The impact is limited by the privileges of the Arena process and network segmentation.

An attacker who successfully exploits these vulnerabilities can execute arbitrary code with the same privileges as the Arena Simulation software process. This could potentially allow further compromise depending on the deployment and network segmentation of Arena within an organization. The vulnerabilities do not allow remote exploitation without user interaction, limiting the attack vector to social engineering or targeted delivery of malicious files. There is no evidence of active exploitation in the wild.

Rockwell Automation has released version 17.00.01 of Arena Simulation software that patches these vulnerabilities. Organizations using affected versions should upgrade to 17.00.01 or later. Exploitation requires user interaction to open a malicious file, so user awareness and cautious handling of Arena experiment and model files can reduce risk. There is no indication that additional mitigations are required beyond applying the official patch.