CISA republishes Rockwell Automation advisory on four RSLinx Classic flaws

By Atlas Watchline Staff · Regulatory · September 1, 2026

CISA says Rockwell Automation fixed four denial-of-service vulnerabilities in RSLinx Classic version 4.60. Users on version 4.50 and earlier should upgrade.

CISA republished a Rockwell Automation advisory on Sept. 1, 2026, warning that four vulnerabilities in RSLinx Classic versions 4.50 and earlier could allow an attacker to trigger a denial-of-service condition.

The advisory says successful exploitation could cause the service to crash and require a restart. Rockwell Automation says the product is deployed worldwide and is used in the critical manufacturing sector.

CISA identified four CVEs: CVE-2026-9621, CVE-2026-9622, CVE-2026-9624 and CVE-2026-9625. The agency assigned a combined CVSS v3 score of 8.6 to the product-level issue.

According to the advisory, CVE-2026-9621 involves improper handling of a malformed packet. CISA said a crafted CIP packet can crash the RSLinx Classic service. The issue is mapped to CWE-190, Integer Overflow or Wraparound, and carries CVSS v3.1 of 8.6 and CVSS v4.0 of 9.2.

CVE-2026-9622 affects the Forward Close service. CISA said a crafted CIP packet can crash that service and force a restart. The issue is mapped to CWE-191, Integer Underflow (Wrap or Wraparound), with the same CVSS v3.1 and v4.0 scores as CVE-2026-9621.

CVE-2026-9624 involves insufficient data length validation. CISA said a crafted CIP packet can crash the service. It is mapped to CWE-191 and carries CVSS v3.1 of 7.5 and CVSS v4.0 of 8.7.

CVE-2026-9625 involves an oversized embedded message request. CISA said the packet can crash the service and mapped the flaw to CWE-120, Buffer Copy without Checking Size of Input, also known as a classic buffer overflow. The scores are CVSS v3.1 of 7.5 and CVSS v4.0 of 8.7.

For remediation, CISA said Rockwell Automation corrected the vulnerabilities in RSLinx Classic version 4.60. Users who cannot upgrade were told to follow Rockwell Automation security best practices and security advisories.

CISA also recommended standard control-system defenses, including limiting network exposure, placing systems behind firewalls, using secure remote access methods such as VPNs, and following internal incident-reporting procedures. The agency said no known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Rockwell Automation reported the vulnerabilities to CISA, according to the advisory. CISA said the advisory was initially released on Sept. 1, 2026 and republished from Rockwell Automation’s notice.

Sources

• CISA Cybersecurity Advisories: ICSA-26-244-01

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.