Rockwell Automation vulnerabilities
We track 228 vulnerabilities in Rockwell Automation products across 60+ products. 228 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 13, 2026.
Latest Rockwell Automation vulnerabilities
- 8.7 High severity
1732E ArmorBlock® I/O: Allocation of Resources Without Limits or Throttling
A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is
- 8.8 High severity
1732E ArmorBlock® I/O: Authentication Bypass by Capture-replay
A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.
- 7.5 High severity
Arena: Out-of-bounds Write
A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerabil
- 7.6 High severity
DataMosaix™ Private Cloud: Improper Authentication
A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project.
- 8.7 High severity
DataEdgePlatform DataMosaix™ Private Cloud: Improper Access Control
A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project.
- 8.7 High severity
DataEdgePlatform DataMosaix™ Private Cloud: Use of Hard-coded Credentials
A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data.
- 8.7 High severity
CompactLogix® 5380 / ControlLogix® 5580: Improper Restriction of Operations within the Bounds of a Memory Buffer
A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault (MNRF), requir
- 7.0 High severity
Redundancy Module Configuration Tool: Incorrect Default Permissions
A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to i
- 7.0 High severity
Redundancy Module Configuration Tool: Incorrect Default Permissions
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to
- 8.7 High severity
RSLinx Classic®: Buffer Copy without Checking Size of Input
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet with an oversized embedded message request can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover.
- 8.7 High severity
RSLinx Classic®: Integer Underflow (Wrap or Wraparound)
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover.
- 8.7 High severity
RSLinx Classic®: Integer Underflow (Wrap or Wraparound)
A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet targeting the Forward Close service can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover.
- 9.2 Critical severity
RSLinx Classic®: Integer Overflow or Wraparound
A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover
- 8.5 High severity
FactoryTalk® Activation Manager: Improper Restriction of Excessive Authentication Attempts
A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An au
- 7.0 High severity
ControlFLASH ®: Missing Authentication for Critical Functionality
A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any comma
- 8.6 High severity
FactoryTalk® Historian Machine Edition: Out-of-bounds Write
A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device.
- 8.7 High severity
1756-ENBT Module: Uncontrolled Resource Consumption
A denial-of-service security issue exists in the affected product. The security issue stems from a crafted CIP packet being sent crashing the module. The device requires a restart to recover.
- 8.7 High severity
ArmorStart® LT: Allocation of Resources Without Limits or Throttling
A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability
- 8.2 High severity
ControlLogix® 5580, CompactLogix® 5380…: Improper Check for Certificate Revocation
A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an inte
- 8.4 High severity
FactoryTalk® DataMosaix™ Private Cloud: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges ca
- 7.5 High severity
Studio 5000 Logix Designer: Unquoted Search Path or Element
A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these pat
- 7.5 High severity
Studio 5000 Logix Designer: Incorrect Authorization
A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited
- 7.5 High severity
Studio 5000 Logix Designer: Improper Limitation of a Pathname to a Restricted Directory
A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening pro
- 8.7 High severity
The FLEX 5000® EtherNet/IP Adapter: Double Free
A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associate
- 7.2 High severity
FactoryTalk ThinManager: Improper Limitation of a Pathname to a Restricted Directory
A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system
- 9.2 Critical severity
CompactLogix® 5380 Recovery Image Compact…: Buffer Copy without Checking Size of Input
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable
- 8.7 High severity
1756-EN2, 1756-EN3: Improper Validation of Integrity Check Value
A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt
- 8.7 High severity
1718-AENTR/1719-AENTR: Allocation of Resources Without Limits or Throttling
A denial-of-service security issue exists in the 1719-AENTR. The security issue stems from improper handling of a UDP unicast network storm, which causes the device to become overloaded and lose communication. A power cycle is required to recover.
- 8.8 High severity
FactoryTalk® Services Platform: Weak Authentication
A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RS
- 9.2 Critical severity
CompactLogix® 5370 Compact GuardLogix® 5370…: Buffer Copy without Checking Size of Input
A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
- 9.2 Critical severity
CompactLogix® 5370 Compact GuardLogix® 5370…: Buffer Copy without Checking Size of Input
A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
- 7.3 High severity
Arena® Simulation: Out-of-bounds Write
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could
- 7.3 High severity
Arena® Simulation: Out-of-bounds Write
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could
- 7.3 High severity
Arena® Simulation: Out-of-bounds Write
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could
- 7.3 High severity
Arena® Simulation: Out-of-bounds Write
A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could
- 8.7 High severity
CompactLogix, ControlLogix: Improper Resource Shutdown or Release
A denial of service security issue exists in the affected product. The security issue stems from a fault occurring when a crafted CIP message is sent. Devices with less memory are more likely to be affected. This can result in a major nonrecoverable fault (MNR
- 8.8 High severity
FLEX I/O EtherNet/IP Adapters: Missing Authentication for Critical Functionality
An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server. The vulnerability allows an unauthenticated attacker to change the device's web interface password by sending a crafted HTTP GET request to a specific endpoin
- 8.7 High severity
FLEX I/O EtherNet/IP Adapters: Missing Release of Memory after Effective Lifetime
A denial-of-service security issue exists within the 1794-AENTR adapter due to improper memory handling of CIP protocol requests. This vulnerability can result in the adapter faulting and losing connection to its associated I/O modules, requiring a manual rese
- 8.3 High severity
FactoryTalk Analytics PavilionX: Missing Authorization
A security issue was identified in Pavilion due to improper authorization enforcement in API endpoints. This vulnerability can allow an unauthorized actor to execute privileged operations, including user/role management and other administrative actions.
- 9.2 Critical severity
FactoryTalk Historian SE: Concurrent Execution using Shared Resource with Improper Synchronization
An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpoint, an attacker may obtain a valid authentication token.