Rockwell Automation vulnerabilities
We track 228 vulnerabilities in Rockwell Automation products across 60+ products. 228 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 13, 2026.
Latest Rockwell Automation vulnerabilities
- 8.7 High severity
CompactLogix 5370: Improper Validation of Integrity Check Value
A security issue exists within 1769 CompactLogix controllers due to the missing validation of sequence numbers and source IP addresses in the CIP protocol. This allows attacker to abuse the exposed Connection ID’s visible on the web interface to perform denial
- 7.5 High severity
ArmorStart® LT: Uncontrolled Resource Consumption
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP and CIP grammar tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- 7.5 High severity
ArmorStart® LT: Uncontrolled Resource Consumption
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive grammar tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- 7.5 High severity
ArmorStart® LT: Uncontrolled Resource Consumption
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. This vulnerability is triggered during fuzzing of multiple CIP classes, which causes the CIP port to become unresponsive.
- 7.5 High severity
ArmorStart® LT: Uncontrolled Resource Consumption
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limits Storms tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several second
- 7.5 High severity
ArmorStart® LT: Uncontrolled Resource Consumption
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive limited storm tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- 7.5 High severity
ArmorStart® LT: Uncontrolled Resource Consumption
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive step limit storm tests, the device reboots
- 7.5 High severity
ArmorStart® LT: Uncontrolled Resource Consumption
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. Fuzzing performed using Defensics causes the device to become unresponsive, requiring a reboot.
- 7.5 High severity
ArmorStart® LT: Uncontrolled Resource Consumption
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limit Storm tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- 7.5 High severity
ArmorStart® LT: Uncontrolled Resource Consumption
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. After running a Burp Suite active scan, the device loses ICMP connectivity, causing the web application to become inaccessible.
- 8.8 High severity
Verve Asset Manager: Cleartext Storage of Sensitive Information
A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext secrets incorrectly stored when a playbook is running. This component has been retired and has been optional since the 1.36 release in 2024
- 8.6 High severity
Verve Asset Manager: Insecure Storage of Sensitive Information
A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on the ADI server. This component has been retired and has been optional since the 1.36 release in 2024.
- 8.7 High severity
ControlLogix® Redundancy Enhanced Module: Missing Release of Memory after Effective Lifetime
Multiple denial-of-service vulnerabilities exist in the affected product. These issues can be triggered through various crafted inputs, including malformed Class 3 messages, memory leak conditions, and other resource exhaustion scenarios. Exploitation may caus
- 7.1 High severity
CompactLogix® 5370: Improper Validation of Specified Quantity in Input
A denial-of-service security issue in the affected product. The security issue occurs when a malformed CIP forward open message is sent. This could result in a major nonrecoverable fault a restart is required to recover.
- 8.7 High severity
Micro820®, Micro850®, Micro870®: Release of Invalid Pointer or Reference
A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and F
- 8.7 High severity
432ES-IG3 Series A: Allocation of Resources Without Limits or Throttling
A security issue exists within 432ES-IG3 Series A, which affects GuardLink® EtherNet/IP Interface, resulting in denial-of-service. A manual power cycle is required to recover the device.
- 8.7 High severity
FactoryTalk® DataMosaix™ Private Cloud: Improper Neutralization of Special Elements used in an SQL Command
A security issue was discovered in DataMosaix Private Cloud, allowing users with low privilege to perform sensitive database operations through exposed API endpoints.
- 7.3 High severity
Arena® Simulation: Stack-based Buffer Overflow
Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability. The specific flaw exists within the parsing of DOE files. Local attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of Are
- 8.9 High severity
Studio 5000 ® Simulation Interface: Exposure of Sensitive Information to an Unauthorized Actor
A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to extract files using path traversal sequences, resulting in execution of scripts with Administrator p
- 8.9 High severity
Studio 5000® Simulation Interface™: Improper Limitation of a Pathname to a Restricted Directory
A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to trigger outbound SMB requests, enabling the capture of NTLM hashes.
- 8.6 High severity
FactoryTalk® DataMosaix™ Private Cloud: Improper Encoding or Escaping of Output
A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in the execution of malicious JavaScript, allowing for account takeover, credential theft, or redirection to a malicious website.
- 7.6 High severity
FactoryTalk® DataMosaix™ Private Cloud: Weak Authentication
A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day per
- 7.7 High severity
1715-AENTR EtherNet/IP Adapter: Out-of-bounds Write
A denial-of-service security issue exists in the affected product and version. The security issue is caused through CIP communication using crafted payloads. The security issue could result in no CIP communication with 1715 EtherNet/IP Adapter.A restart is req
- 7.7 High severity
1715-AENTR EtherNet/IP Adapter: Allocation of Resources Without Limits or Throttling
A denial-of-service security issue exists in the affected product and version. The security issue stems from a high number of requests sent to the web server. This could result in a web server crash however; this does not impact I/O control or communication .
- 8.7 High severity
Compact GuardLogix® 5370: Uncaught Exception
A denial-of-service security issue in the affected product. The security issue stems from a fault occurring when a crafted CIP unconnected explicit message is sent. This can result in a major non-recoverable fault.
- 7.8 High severity
FactoryTalk Linx: Improper Privilege Management
A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed with FTLinx. Authenticated attackers with valid Windows Users credentials can initiate a repair and hijack the resulting co
- 7.8 High severity
FactoryTalk Linx: Improper Privilege Management
A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows user credentials can initiate a repair and hijack the resulting console window. This allows the launching of a command prom
- 8.7 High severity
A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated…
A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perform XXE, resulting in a temporary denial-of-service.
- 9.1 Critical severity
FactoryTalk View Machine Edition: Improper Limitation of a Pathname to a Restricted Directory
A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panels operating system. Exploitation of this vulnerability is dependent on the k
- 9.8 Critical severity
PanelView Plus 7 Performance Series B: Improper Authentication
An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval o
- 9.8 Critical severity
Comms - 1783-NATR: Missing Authentication for Critical Functionality
Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical functions. These could result in potential denial-of-service, admin account takeover, or NAT rule modificatio
- 8.7 High severity
ArmorStart AOP: Improper Handling of Exceptional Conditions
A security issue exists within the Studio 5000 Logix Designer add-on profile (AOP) for the ArmorStart Classic distributed motor controller, resulting in denial-of-service. This vulnerability is possible due to the input of invalid values into Component Object
- 8.8 High severity
FactoryTalk® Analytics™ LogixAI®: Exposure of Sensitive System Information to an Unauthorized Control Sphere
An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an attacker on the intranet accessing sensitive data and potential alteration of data.
- 7.5 High severity
ControlLogix® 5580: NULL Pointer Dereference
A denial-of-service security issue exists in the affected product and version. The security issue stems from the controller repeatedly attempting to forward messages. The issue could result in a major nonrecoverable fault on the controller.
- 8.8 High severity
FactoryTalk Optix: Improper Neutralization of Special Elements used in a Command
A security issue exists within FactoryTalk Optix MQTT broker due to the lack of URI sanitization. This flaw enables the loading of remote Mosquito plugins, which can be used to achieve remote code execution.
- 7.0 High severity
CompactLogix® 5480: Missing Authentication for Critical Functionality
A code execution security issue exists in the affected product. An attacker with physical access could abuse the maintenance menu of the controller with a crafted payload. The security issue can result in arbitrary code execution.
- 8.8 High severity
ThinManager: Server-Side Request Forgery
A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® servic
- 7.5 High severity
FactoryTalk Activation Manager: Missing Authentication for Critical Functionality
A security issue exists within FactoryTalk Activation Manager. An error in the implementation of cryptography within the software could allow attackers to decrypt traffic. This could result in data exposure, session hijacking, or full communication compromise.
- 8.6 High severity
Stratix IOS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can lead to remote code execution by uploading and running malicious configurations without authentication.
- 9.3 Critical severity
A security issue exists due to improper handling of malformed CIP Forward Close packets during…
A security issue exists due to improper handling of malformed CIP Forward Close packets during fuzzing. The controller enters a solid red Fault LED state and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED a