Rockwell Automation vulnerabilities
We track 228 vulnerabilities in Rockwell Automation products across 60+ products. 228 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 13, 2026.
Latest Rockwell Automation vulnerabilities
- 7.5 High severity
ThinManager: Inadequate Encryption Strength
Rockwell Automation ThinManager product allows the use of medium strength ciphers. If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.
- 9.1 Critical severity
Kinetix 5500 EtherNet/IP Servo Drive: Improper Access Control
Rockwell Automation was made aware that Kinetix 5500 drives, manufactured between May 2022 and January 2023, and are running v7.13 may have the telnet and FTP ports open by default. This could potentially allow attackers unauthorized access to the device throu
- 7.1 High severity
ArmorStart ST: Improper Neutralization of Input During Web Page Generation
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is
- 7.1 High severity
ArmorStart ST: Improper Neutralization of Input During Web Page Generation
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is
- 8.8 High severity
Arena Simulation: Out-of-bounds Write
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the hea
- 9.8 Critical severity
Arena Simulation: Out-of-bounds Read
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow in the hea
- 9.8 Critical severity
Arena Simulation: Out-of-bounds Read
An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow potentiall
- 9.1 Critical severity
KEPServerEX: Improper Restriction of Operations within the Bounds of a Memory Buffer
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conver
- 9.8 Critical severity
KEPServerEX: Stack-based Buffer Overflow
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conver
- 7.5 High severity
ThinManager ThinServer: Out-of-bounds Read
In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerabil
- 7.5 High severity
ThinManager ThinServer: Improper Limitation of a Pathname to a Restricted Directory
In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.ex
- 9.8 Critical severity
ThinManager ThinServer: Improper Limitation of a Pathname to a Restricted Directory
In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk driv
- 9.8 Critical severity
ThingWorx Edge C-SDK: Improper Validation of Array Index
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.
- 9.8 Critical severity
ThingWorx Edge C-SDK: Integer Overflow or Wraparound
The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code.
- 7.8 High severity
Studio 5000 Logix Emulate: Improper Authentication
A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software. Users are granted elevated permissions on certain product services when the software is installed. Due to this misconfiguration, a malicious user could pote
- 7.5 High severity
An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined…
An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-of-service condition in Rockwell Automation Logix controllers resulting in a major non-recoverable fault. If the target d
- 7.5 High severity
A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP…
A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-of-service condition (DOS).
- 7.5 High severity
MicroLogix 1100: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to a denial-of-service condition. The security vulnerability could be exploited by an attacker with network access to the a
- 7.5 High severity
FactoryTalk Alarm and Events Server: Improper Authentication
An unauthenticated attacker with network access to a victim's Rockwell Automation FactoryTalk Alarm and Events service could open a connection, causing the service to fault and become unavailable. The affected port could be used as a server ping port and uses
- 9.8 Critical severity
ThinManager ThinServer: Out-of-bounds Write
Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is vulnerable to a heap-based buffer overflow. An attacker could send a specifically crafted TFTP or HTTPS request, causing a heap-based buffer overflow that crashes the ThinServer process. If
- 7.8 High severity
ISaGRAF Workbench: Deserialization of Untrusted Data
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a m
- 7.8 High severity
ISaGRAF Workbench: Improper Limitation of a Pathname to a Restricted Directory
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an attacker to traverse the file system when opened by ISaGRAF Workbench. If successfully exploited, an
- 7.8 High severity
ISaGRAF Workbench: Improper Limitation of a Pathname to a Restricted Directory
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the s
- 8.6 High severity
CompactLogix 5380 controllers: Uncontrolled Resource Consumption
A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable fault. If the target device becomes unavailable, a user would
- 7.8 High severity
Connected Component Workbench: Deserialization of Untrusted Data
Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craf
- 9.8 Critical severity
1768 CompactLogix controllers: Inclusion of Functionality from Untrusted Control Sphere
An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5000 Logix Designer writes user-readable program code to a separate location than the executed compile
- 7.2 High severity
Studio 5000 Logix Designer: Improper Control of Generation of Code
Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.
- 9.8 Critical severity
Rockwell Multiple Products Insufficient Protected Credentials Exploited
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5