Rockwell Automation vulnerabilities
We track 228 vulnerabilities in Rockwell Automation products across 60+ products. 228 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 13, 2026.
Latest Rockwell Automation vulnerabilities
- 9.8 Critical severity
Due to an improper input validation, an unauthenticated threat actor can send a malicious…
Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote code execution condition on the Rockwell Automation ThinManager® ThinServer™.
- 8.8 High severity
FactoryTalk® View SE: Incorrect Permission Assignment for Critical Resource
A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lists, and potentially gaining further access within the system.
- 7.5 High severity
FactoryTalk® View SE: Missing Authentication for Critical Functionality
A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project. Due to the lack of proper authenticat
- 7.5 High severity
FactoryTalk® View SE: Improper Authentication
A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project. This action is allowed without pr
- 9.8 Critical severity
FactoryTalk® View SE: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. If exploite
- 7.0 High severity
FactoryTalk® Remote Access™: Unquoted Search Path or Element
An unquoted executable path exists in the Rockwell Automation FactoryTalk® Remote Access™ possibly resulting in remote code execution if exploited. While running the FTRA installer package, the executable path is not properly quoted, which could allow a threat
- 7.5 High severity
A specific malformed fragmented packet type (fragmented packets may be generated automatically…
A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send large amounts of data) can cause a major nonrecoverable fault (MNRF) Rockwell Automation's ControlLogix 5580, Guard Logix 5580, CompactLogix 538
- 7.5 High severity
An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes…
An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes the secondary adapter to result in a major nonrecoverable fault (MNRF) when malicious input is entered. If exploited, the availability of the device will be impacted,
- 7.8 High severity
Arena Simulation: Out-of-bounds Write
A memory corruption vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by corrupting the memory triggering an access violation. Once inside, the threat actor can r
- 7.1 High severity
Arena Simulation: Out-of-bounds Read
A memory buffer vulnerability in Rockwell Automation Arena Simulation could potentially let a threat actor read beyond the intended memory boundaries. This could reveal sensitive information and even cause the application to crash, resulting in a denial-of-ser
- 7.8 High severity
Arena Simulation: Access of Uninitialized Pointer
An uninitialized pointer in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by leveraging the pointer after it is properly. Once inside, the threat actor can run harmful code on
- 7.8 High severity
Arena Simulation: Use After Free
A memory buffer vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by corrupting the memory and triggering an access violation. Once inside, the threat actor can r
- 7.8 High severity
Arena Simulation: Out-of-bounds Write
A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code into the software by overstepping the memory boundaries, which triggers an access violation.
- 7.8 High severity
Arena Simulation: Out-of-bounds Write
An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into the software. This is done by writing beyond the designated memory area, which causes an access violation. Once inside, t
- 7.5 High severity
A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to…
A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper traffic throttling in the device. If multiple data packets are sent to the device repeatedly the device will crash and require a manual restart to recover.
- 7.5 High severity
A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to…
A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption in the CIP communication will occur and a manual restart will be required by the user to recover it.
- 7.5 High severity
A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to…
A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, the web server will crash and need a manual restart to recover it.
- 8.8 High severity
FactoryTalk® Service Platform: Incorrect Permission Assignment for Critical Resource
A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A
- 9.1 Critical severity
FactoryTalk® Service Platform: Improper Verification of Cryptographic Signature
A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service to
- 7.5 High severity
ControlLogix® 5570: Improper Restriction of Operations within the Bounds of a Memory Buffer
A denial-of-service vulnerability exists in specific Rockwell Automation ControlLogix ang GuardLogix controllers. If exploited, the product could potentially experience a major nonrecoverable fault (MNRF). The device will restart itself to recover from the MNR
- 8.1 High severity
FactoryTalk® Services Platform: Improper Authentication
Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® Services Platform web service and then use the token to log in into FactoryTalk® Services Platform . This vu
- 7.5 High severity
Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which…
Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which could potentially allow threat actors to send malicious data bringing the product offline. If exploited, the product would become unavailable and require a restart to
- 7.8 High severity
Arena Simulation: Access of Uninitialized Pointer
Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using an uninitialized pointer in the application. The threat-actor could then
- 7.8 High severity
Arena Simulation: Out-of-bounds Read
An arbitrary code execution vulnerability was reported to Rockwell Automation in Arena Simulation that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow. The threat-actor could then
- 10.0 Critical severity
Cisco IOS XE Web UI Privilege Escalation Exploited
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors e
- 9.1 Critical severity
FactoryTalk Linx: Out-of-bounds Write
FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. Sending a size larger than the buffer size results in leakage of data from memory resulting in an inform
- 9.8 Critical severity
1756-EN2T Series A, B, C: Out-of-bounds Write
A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could potentially leverage this vulnerability to perform a remote code execution. To exploit this vulnerability, a threat acto
- 9.8 Critical severity
Fa: Unrestricted Upload of File with Dangerous Type
Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP c
- 9.8 Critical severity
ThinManager ThinServer: Improper Limitation of a Pathname to a Restricted Directory
The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. If
- 9.1 Critical severity
ThinManager ThinServer: Improper Limitation of a Pathname to a Restricted Directory
The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software processes a certain function. If exploited, an unaut
- 7.5 High severity
ThinManager ThinServer: Integer Overflow or Wraparound
The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, an integer overflow condition exists in the affected products. When the ThinManager processes incoming messages, a read access violation occurs and termin
- 7.5 High severity
Armor PowerFlex: Incorrect Calculation
A vulnerability was discovered in the Rockwell Automation Armor PowerFlex device when the product sends communications to the local event log. Threat actors could exploit this vulnerability by sending an influx of network commands, causing the product to gener
- 7.5 High severity
Kinetix 5700 DC Bus Power Supply Series A: Uncontrolled Resource Consumption
The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing. The new ENIP connections cannot be established if impacted by this vulnerability, which prohibits operational capabilities of the device resulting in a denial-of-se
- 7.5 High severity
1756-EN4TR Series A: Out-of-bounds Write
Where this vulnerability exists in the Rockwell Automation 1756-EN4* Ethernet/IP communication products, it could allow a malicious user to cause a denial of service by asserting the target system through maliciously crafted CIP messages.
- 9.8 Critical severity
1756-EN2T Series A, B, C: Out-of-bounds Write
Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messa
- 9.6 Critical severity
Enhanced HIM: Cross-Site Request Forgery
The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) a
- 8.8 High severity
PowerMonitor 1000: Improper Neutralization of Input During Web Page Generation
The Rockwell Automation PowerMonitor 1000 contains stored cross-site scripting vulnerabilities within the web page of the product. The vulnerable pages do not require privileges to access and can be injected with code by an attacker which could be used to leve
- 7.5 High severity
FactoryTalk Transaction Manager: Uncontrolled Resource Consumption
A denial-of-service vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager. This vulnerability can be exploited by sending a modified packet to port 400. If exploited, the application could potentially crash or experience a high CPU or mem
- 8.2 High severity
FactoryTalk System Services: Use of Hard-coded Credentials
Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lead to privilege escalation. This vulnerability may allow a local, authenticated non-admin user to genera
- 8.8 High severity
FactoryTalk Vantagepoint: Cross-Site Request Forgery
A cross site request forgery vulnerability exists in Rockwell Automation's FactoryTalk Vantagepoint. This vulnerability can be exploited in two ways. If an attacker sends a malicious link to a computer that is on the same domain as the FactoryTalk Vantagepoint