https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Rockwell Automation.Wed, 04 Nov 2026 23:52:47 GMThttps://cisa.gov/news-events/ics-advisories/icsa-26-246-04cst-5656Rockwell Automation ArmorStart LT versions 2.001 and earlier contain two vulnerabilities: CVE-2026-19471, a stored cross-site scripting (XSS) flaw that allows attackers to inject malicious scripts executed when users access affected pages, and CVE-2026-19472, a denial-of-service vulnerability triggered by crafted HTTP PUT requests that disable the web server. Firmware version 2.002 resolves both issues, with CVSS v3.1 scores of 7.3 and 7.5 respectively. Sources: CISA Alerts and Advisories.Thu, 03 Sep 2026 12:00:00 GMThttps://cisa.gov/news-events/ics-advisories/icsa-26-244-01cst-5488Rockwell Automation disclosed four denial-of-service vulnerabilities in RSLinx Classic version 4.50 and earlier, affecting industrial control systems worldwide. The flaws stem from improper handling of crafted CIP packets that can crash the RSLinx Classic service and include integer overflow, integer underflow, and buffer overflow issues. Rockwell Automation has released version 4.60 to address these vulnerabilities, with CVSS v3.1 scores ranging from 7.5 to 8.6 (high severity). Sources: CISA Alerts and Advisories.Tue, 01 Sep 2026 12:00:00 GMThttps://cisa.gov/news-events/ics-advisories/icsa-26-244-04cst-5492Rockwell Automation released a security advisory for FactoryTalk Activation Manager addressing CVE-2026-16675, a privilege escalation vulnerability in versions V5.02 and below. The flaw allows authenticated attackers to hijack installer console windows running with SYSTEM privileges to gain full system access. Rockwell Automation recommends updating to version V5.03 to remediate the issue. Sources: CISA Alerts and Advisories.Tue, 01 Sep 2026 12:00:00 GMThttps://cyberscoop.com/exposed-rockwell-controllers-water-system-attackscst-4019A scan by Forescout's Vedere Labs identified over 4,000 internet-exposed Rockwell Automation and Allen-Bradley controllers, including 22 in cities affected by recent water system cyberattacks. The exposed devices use EtherNet/IP protocol and could allow attackers to identify systems and modify configurations; 19 of the 22 devices in targeted cities appeared vulnerable to CVE-2017-16740, a 2017 remote code execution flaw. Despite years of warnings from manufacturers and federal agencies, direct internet access to industrial control equipment in water and wastewater operations remains widespread. Sources: CyberScoop.Thu, 06 Aug 2026 19:10:21 GMThttps://cisa.gov/news-events/ics-advisories/icsa-26-202-08cst-2935Rockwell Automation released a security advisory for a denial-of-service vulnerability in the 1718-AENTR and 1719-AENTR industrial control system devices. CVE-2026-9140 stems from improper handling of UDP unicast network storms that overload the device and sever communications, requiring a power cycle to restore function. The vendor recommends upgrading to version 3.012 or later. Sources: CISA Alerts and Advisories.Tue, 21 Jul 2026 12:00:00 GMThttps://cisa.gov/news-events/ics-advisories/icsa-26-202-07cst-2938Rockwell Automation disclosed a critical vulnerability (CVE-2026-10714) in FactoryTalk Services Platform v6.60 that allows attackers to bypass JWT signature validation and forge authentication tokens. An authenticated low-privilege user could exploit this flaw to impersonate any authorized user, gaining unauthorized access to system configurations and permissions. Rockwell released patches, including a February 2026 roll-up and individual RAID 1158263, to remediate the issue. Sources: CISA Alerts and Advisories.Tue, 21 Jul 2026 12:00:00 GMThttps://cisa.gov/news-events/ics-advisories/icsa-26-197-06cst-2702Rockwell Automation has disclosed three denial-of-service vulnerabilities (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698) affecting multiple CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix controller models with a CVSS score of 8.6. These flaws could allow a remote attacker to load an invalid project file, causing affected devices to enter a major non-recoverable fault. Rockwell recommends updating to patched versions such as V35.016, V36.011, or later depending on the controller model. Sources: CISA Alerts and Advisories.Thu, 16 Jul 2026 12:00:00 GMThttps://cisa.gov/news-events/ics-advisories/icsa-26-197-02cst-2708Rockwell Automation disclosed a denial-of-service vulnerability (CVE-2026-9653) affecting communication modules 1756-EN2, 1756-EN3, and 1756-ENBT used in critical manufacturing environments worldwide. The flaw stems from improper validation of CIP Implicit Connection packets, allowing network-based attackers to send crafted packets that temporarily disrupt device connections. Patches are available for the EN2 and EN3 modules (version 12.002), though the ENBT module is discontinued with no fix available. Sources: CISA Alerts and Advisories.Thu, 16 Jul 2026 12:00:00 GMT