Critical DoS Vulnerability (CVE‑2026‑9637) in Rockwell Automation Logix Platform Threatens Industrial Control Availability
What It Is – A denial‑of‑service (DoS) flaw (CVE‑2026‑9637) exists in multiple versions of Rockwell Automation’s Logix Platform (ControlLogix, CompactLogix, GuardLogix, Compact GuardLogix). The defect stems from improper validation of input length during CIP message processing, allowing an attacker to trigger a major non‑recoverable fault that forces a power‑cycle to restore operation.
Exploitability – The vulnerability is publicly disclosed with a CVSS v3 score of 7.5 (High). No public exploit code has been released, but the attack vector is straightforward: crafted CIP messages can be sent over the control network by any actor with network access.
Affected Products – Rockwell Automation Logix Platform, covering ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, and Compact GuardLogix 5380 firmware versions up to V36.012 (see advisory for exact version ranges).
Why It Matters for Trust & Control Assurance
- Incident‑response readiness – Organizations must demonstrate that they can detect, contain, and recover from availability‑impacting events; this CVE tests the effectiveness of those processes.
- Continuous control monitoring – Evidence of timely patch management and configuration baselines becomes critical audit evidence when a DoS‑type flaw is disclosed.
- Defensible audit trail – Showing documented remediation (patches applied, rollback procedures exercised) satisfies multiple control objectives across frameworks, reinforcing buyer confidence in the supply‑chain’s resilience.
Recommended Actions
- Validate inventory – Identify all Logix devices running the listed firmware versions.
- Apply patches – Deploy Rockwell’s remediation firmware as soon as it is available; if patches are pending, implement compensating network‑segmentation controls.
- Update incident‑response playbooks – Include specific steps for detecting CIP‑message anomalies and executing rapid power‑cycle recovery.
- Capture evidence – Record patch status and response drills in a centralized control‑evidence repository to support audit readiness.
Source: CISA Advisory – ICSA‑26‑244‑03