High severity · published Sep 3, 2026
CVE-2026-6071
Code Execution Vulnerability in Arena®
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a malicious page or open a malicious file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Arena · Rockwell Automation
All versions 16.20.08 and prior · source: vendor
In the news
VulnerabilityHigh
ZDI-26-438: Rockwell Automation Arena Simulation DOE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Arena Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-6071.
Jul 15, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6071
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6071
www.rockwellautomation.com
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1713.html
More from Arena
7.8
CVE-2025-6376
Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
7.8
CVE-2025-6377
Arena® Simulation Out-Of-Bounds Write Remote Code Execution Vulnerability
7.8
CVE-2025-3289
Local Code Execution Vulnerability in Arena®
7.8
CVE-2025-3288
Local Code Execution Vulnerability in Arena®
7.8
CVE-2025-3287
Local Code Execution Vulnerability in Arena®