Rockwell Automation vulnerabilities
We track 228 vulnerabilities in Rockwell Automation products across 60+ products. 228 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 13, 2026.
Latest Rockwell Automation vulnerabilities
- 9.3 Critical severity
PM1k 1408-BC3A-485: Buffer Copy without Checking Size of Input
A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer-overflow, potentially causing denial-of-service.
- 9.3 Critical severity
PM1k 1408-BC3A-485: Improper Control of Generation of Code
A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for rem
- 9.3 Critical severity
PM1k 1408-BC3A-485: Missing Authentication for Critical Functionality
A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit ope
- 7.8 High severity
Arena®: Out-of-bounds Read
An “out of bounds read” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to read beyond the boundaries of an allocated memory. If exploited, a threat actor could le
- 8.5 High severity
Arena®: Improper Initialization
An “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable before it being initialized. If exploited, a threat actor could le
- 7.8 High severity
Arena®: Out-of-bounds Write
An “out of bounds write” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to e
- 8.5 High severity
Arena®: Use After Free
A “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to use a resource that was already used. If exploited, a threat actor could leverage this vulner
- 7.3 High severity
Arena Input Analyzer: Improper Validation of Specified Quantity in Input
A memory corruption vulnerability exists in the affected products when parsing DFT files. Local threat actors can exploit this issue to disclose information and to execute arbitrary code. To exploit this vulnerability a legitimate user must open a malicious DF
- 7.3 High severity
FactoryTalk Updater: Improper Check for Unusual or Exceptional Conditions
A Local Privilege Escalation vulnerability exists in the affected product. The vulnerability requires a local, low privileged threat actor to replace certain files during update and exists due to a failure to perform proper security checks before installation.
- 8.4 High severity
A Remote Code Execution vulnerability exists in the affected product.
A Remote Code Execution vulnerability exists in the affected product. The vulnerability requires a high level of permissions and exists due to improper input validation resulting in the possibility of a malicious Updated Agent being deployed.
- 9.1 Critical severity
FactoryTalk Updater: Insecure Storage of Sensitive Information
An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could allow a threat actor to impersonate a user if the threat actor is able to enumerate additional information required
- 7.8 High severity
A remote code execution vulnerability exists in the affected product.
A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public directory allowing anyone with local access to modify and/or delete files. Additionally, a malicious user could potentially
- 7.5 High severity
FactoryTalk ThinManager: Out-of-bounds Read
CVE-2024-10387 IMPACT A Denial-of-Service vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in Denial-of-Service.
- 9.8 Critical severity
FactoryTalk ThinManager: Missing Authentication for Critical Functionality
CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulation.
- 7.5 High severity
CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/adviso…
CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a specially crafted CIP message to the device. If exploited, a threat actor could help prevent access to the legitimate user and end connecti
- 7.8 High severity
RSLogix 500®: Insufficient Verification of Data Authenticity
VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected
- 8.4 High severity
Verve® Asset Manager: Placement of User into Incorrect Group
An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the
- 7.5 High severity
Drives - PowerFlex 6000T: Improper Check for Unusual or Exceptional Conditions
A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 600T. If the device is overloaded with requests, it will become unavailable. The device may require a power cycle to recover it if it does not re-establish a connection after it sto
- 7.5 High severity
CompactLogix 5380 controllers: Missing Release of Memory after Effective Lifetime
Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability by performing multiple actions on certain web pages of the product causing the affected products to
- 9.8 Critical severity
Pavilion8®: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the Rockwell Automation affected product. If exploited, the threat actor could upload arbitrary files to the server that could result in a remote code execution.
- 9.1 Critical severity
Pavilion8®: Improper Privilege Management
The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive information and change settings. The vulnerability exists due to having an incorrect privilege matrix that allows users to have access to functions t
- 8.8 High severity
2800C OptixPanel™ Compact: Incorrect Default Permissions
A privilege escalation vulnerability exists in the Rockwell Automation affected products. The vulnerability occurs due to improper default file permissions allowing users to exfiltrate credentials and escalate privileges.
- 7.5 High severity
A denial-of-service vulnerability exists in the Rockwell Automation affected products when…
A denial-of-service vulnerability exists in the Rockwell Automation affected products when specially crafted packets are sent to the CIP Security Object. If exploited the device will become unavailable and require a factory reset to recover.
- 8.8 High severity
ThinManager: Externally Controlled Reference to a Resource in Another Sphere
CVE-2024-45826 IMPACT Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file.
- 7.5 High severity
CVE-2024-45825 IMPACT A denial-of-service vulnerability exists in the affected products.
CVE-2024-45825 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service.
- 9.8 Critical severity
FactoryTalk® Batch View™: Improper Authentication
CVE-2024-45823 IMPACT An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and could allow a threat actor to impersonate a user if the threat actor is able to enumerate additional
- 9.8 Critical severity
FactoryTalk View Site Edition: Improper Neutralization of Special Elements used in a Command
CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traversal, Command Injection, and XSS Vulnerabilities and allows for full unauthenticated remote code execution. The link in the
- 9.3 Critical severity
A remote code execution vulnerability exists in the Rockwell Automation ThinManager®…
A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with System privileges. This vulnerability exists due to the lack of proper data input validation, which allow
- 7.8 High severity
ThinManager® ThinServer™: Unrestricted Upload of File with Dangerous Type
A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with System privileges. To exploit this vulnerability and a threat actor must abuse the ThinServer™ service by
- 7.5 High severity
ThinManager® ThinServer™: Incorrect Permission Assignment for Critical Resource
A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can exploit this vulnerability by abusing the ThinServer™ service to read arbitrary files by creating a junct
- 7.5 High severity
CVE-2024-7515 IMPACT A denial-of-service vulnerability exists in the affected products.
CVE-2024-7515 IMPACT A denial-of-service vulnerability exists in the affected products. A malformed PTP management packet can cause a major nonrecoverable fault in the controller.
- 8.8 High severity
FactoryTalk View Site Edition: Incorrect Permission Assignment for Critical Resource
CVE-2024-7513 IMPACT A code execution vulnerability exists in the affected product. The vulnerability occurs due to improper default file permissions allowing any user to edit or replace files, which are executed by account with elevated permissions.
- 8.6 High severity
DataMosaix™: Improper Authentication
CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any user ID without the use of a username or password. If exploited, a malicious user could take over the a
- 7.5 High severity
Pavilion8®: Missing Encryption of Sensitive Data
CVE-2024-40620 IMPACT A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of pro
- 7.5 High severity
ControlLogix® 5580: Improper Check for Unusual or Exceptional Conditions
CVE-2024-40619 IMPACT A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service.
- 7.3 High severity
ControlLogix® 5580 (1756-L8z): Unprotected Alternate Channel
A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP co
- 7.5 High severity
An input validation vulnerability exists in the Rockwell Automation 5015 - AENFTXT when a…
An input validation vulnerability exists in the Rockwell Automation 5015 - AENFTXT when a manipulated PTP packet is sent, causing the secondary adapter to result in a major nonrecoverable fault. If exploited, a power cycle is required to recover the product.
- 8.8 High severity
Pavilion8®: Incorrect Permission Assignment for Critical Resource
A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should only be available to users with administrative level privileges. If exploited, an attacker could read
- 7.5 High severity
Due to an improper input validation, an unauthenticated threat actor can send a malicious…
Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automation ThinServer™ and cause a denial-of-service condition on the affected device.
- 9.8 Critical severity
Due to an improper input validation, an unauthenticated threat actor can send a malicious…
Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote code execution condition on the Rockwell Automation ThinManager® ThinServer™.