High severity · published Sep 1, 2026
CVE-2026-9637
CompactLogix® 5380 / ControlLogix® 5580 - Multiple Vulnerabilities
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault (MNRF), requiring a power cycle to recover
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C5
CompactLogix® 5380 / ControlLogix® 5580 · Rockwell Automation
V33 and prior, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012 · source: vendor
In the news
VulnerabilityHigh
Rockwell Automation Logix Platform
View CSAF
Summary
The following versions of Rockwell Automation Logix Platform are affected:
ControlLogix 5580 <=V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012 (CVE-2026-9637, CVE-2026-9637, CVE-2026-9637, CVE-2026-9637)
CompactLogix 5380 <=V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012 (CVE-2026-9637, CVE-2026-9637, CVE-2026-9637, CVE-2026-9637)
GuardLogix 5580 <=V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012 (CVE-2026-9637, CVE-2026-9637, CVE-2026-9637, CVE-2026-9637)
Compact GuardLogix 5380 <=V33, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012 (CVE-2026-9637, CVE-2026-9637, CVE-2026-9637, CVE-2026-9637)
CVSS
Vendor
Equipment
Vulnerabilities
v3 7.5
Rockwell Automation
Rockwell Automation Logix Platform
Improper Restriction of Operations within the Bounds of a Memory Buffer
Background
Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: United States
Vulnerabilities
Expand All +
CVE-2026-9637
A denial-of-service vulnerability exists in the affected Logix platforms due to improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault (MNRF), requiring a power cycle to recover.
View CVE Details
Affected Products
Rockwell Automation Logix Platform
Vendor: Rockwell Automation
Product Version: Rockwell Autom...
Sep 1, 2026·CISA Advisories
Affected product
C5
CompactLogix® 5380 / ControlLogix® 5580
Rockwell Automation