As reported by CISA's ICS Advisory program (ICSA-26-197-02), a high-severity denial-of-service vulnerability has been identified in Rockwell Automation's widely deployed 1756-series EtherNet/IP communication modules. While the advisory notes that disrupted device connections will recover, the operational implications for critical manufacturing environments deserve far more scrutiny than a surface reading might suggest.

Security Impact: As reported by CISA's ICS Advisory program (ICSA-26-197-02), a high-severity denial-of-service vulnerability has been identified in Rockwell Automation's widely deployed 1756-series EtherNet/IP communication modules.

Vulnerability At a Glance

CVE ID
CVE-2026-9653
CVSS v3 Score
7.5 — High
Affected Vendor
Rockwell Automation (United States)
Affected Products & Versions
Vulnerability At a Glance
1756-EN3 — firmware â‰Ī V12.001
1756-EN2 — firmware â‰Ī V12.001
1756-ENBT — firmware V6.006
Vulnerability Class
Improper Validation of Integrity Check Value (CIP Implicit Connection packets)
Attack Vector
Network-accessible, no authentication required
Exploitation in the Wild
Not confirmed at time of advisory publication
Patch / Mitigation Available
Refer to CISA Advisory ICSA-26-197-02 and Rockwell Automation's official security bulletin for remediation guidance
Sectors at Risk
Critical Manufacturing — globally deployed

Why This Is More Serious Than a "Recoverable" DoS

The advisory's note that device connections "will recover" after disruption may tempt some operators to deprioritize this finding. That would be a mistake. In industrial control system (ICS) and operational technology (OT) environments, even momentary communication disruptions between PLCs and their EtherNet/IP communication modules can have cascading consequences — including process shutdowns, safety system activations, equipment damage, and loss of visibility for operators during a critical window.

The 1756-series ControlLogix backplane is among the most commonly deployed architectures in heavy manufacturing, automotive, oil and gas, and discrete production environments worldwide. An attacker who can sustain repeated packet floods — even without achieving persistent access — can effectively render a production line unreliable or untrustworthy without ever compromising the underlying PLC logic.

The real threat model here is not a single disruptive event, but a low-and-slow harassment campaign that erodes operator confidence, triggers false alarms, or masks a simultaneous intrusion on adjacent systems.

Attack Surface Considerations

CIP (Common Industrial Protocol) Implicit Connections are used for real-time I/O data exchange — they are by design low-latency and high-frequency. This makes them an attractive target: crafted malformed packets can be injected at high rates with minimal tooling, and the improper integrity check validation means the module cannot distinguish legitimate traffic from weaponized traffic. Any threat actor with network adjacency to the OT segment — whether through a compromised IT host, a misconfigured firewall, or direct physical access to a network tap — could exploit this with relatively low sophistication.

This is particularly concerning given the documented trend of ransomware and nation-state actors pre-positioning on IT networks before pivoting to OT environments. A vulnerability like CVE-2026-9653 becomes a highly effective disruption tool in the second phase of such an attack chain.

Shield53 Recommendations

Immediate Actions

  • Inventory now: Identify all deployed 1756-EN2, EN3, and ENBT modules in your environment. Cross-reference firmware versions against affected ranges (â‰ĪV12.001 for EN2/EN3; V6.006 for ENBT).
  • Apply vendor patches: Follow Rockwell Automation's official security bulletin for firmware updates. Do not delay patching due to change management inertia — schedule an expedited maintenance window.
  • Network segmentation: Ensure OT/ICS networks are isolated from corporate IT networks via properly configured industrial DMZs. CIP traffic should never be reachable from untrusted network zones.
  • Deploy CIP-aware monitoring: Use ICS-specific network monitoring tools (e.g., Dragos, Claroty, Nozomi) with signatures tuned to detect anomalous CIP Implicit Connection traffic patterns — particularly high-rate or malformed packet floods.
  • Firewall and ACL review: Restrict inbound CIP traffic (UDP/TCP port 2222 and 44818) to explicitly trusted sources only. Deny-all defaults with allowlist exceptions are strongly preferred.
  • Incident response readiness: Brief OT operations teams on what a DoS event on these modules looks like operationally so that legitimate faults are not confused with adversarial activity — and vice versa.

Longer-Term Posture

  • Develop a formal OT asset lifecycle program that tracks firmware currency for all network-connected industrial devices — not just Rockwell assets.
  • Conduct tabletop exercises simulating sustained CIP disruption scenarios to validate recovery procedures and inter-team communication protocols.
  • Evaluate whether legacy ENBT modules (with more constrained firmware update paths) should be prioritized for hardware refresh given their persistent attack surface.

Vulnerabilities in EtherNet/IP communication modules are not abstract risks — they sit directly in the data path between your control systems and your physical processes. Treat CVE-2026-9653 with the operational urgency it warrants.