As reported by CISA in advisory ICSA-26-244-01, Rockwell Automation's RSLinx Classic — a widely deployed communications utility for Allen-Bradley PLCs and other industrial controllers — contains four remotely exploitable denial-of-service vulnerabilities affecting all versions through 4.50. While DoS flaws in IT software are often deprioritized, in operational technology contexts a service crash can mean halted production lines, safety system disruptions, and cascading downtime costs measured in hundreds of thousands of dollars per incident.

Security Impact: As reported by CISA in advisory ICSA-26-244-01, Rockwell Automation's RSLinx Classic — a widely deployed communications utility for Allen-Bradley PLCs and other industrial controllers — contains four remotely exploitable denial-of-service vulnerabilities affecting all versions through 4.50.

Vulnerability Summary

CVECVSS v3.1CVSS v4.0TypeImpact
CVE-2026-96218.6 High9.2 CriticalInteger Overflow (CWE-190)Service crash via malformed CIP packet
CVE-2026-96228.6 High9.2 CriticalInteger UnderflowService crash via Forward Close CIP packet
CVE-2026-9624HighCriticalBuffer OverflowService crash
CVE-2026-9625HighCriticalBuffer OverflowService crash

Affected products: Rockwell Automation RSLinx Classic versions <=4.50

Patch available: Yes — upgrade to RSLinx Classic version 4.60

Active exploitation: Not confirmed in the wild at time of advisory publication, but the network-accessible, no-authentication attack surface makes preemptive patching critical.

Why This Matters More Than a Typical DoS Advisory

The CVSS v3.1 vector string AV:N/AC:L/PR:N/UI:N/S:C tells the real story: these flaws are exploitable over the network with low complexity, no credentials, and no user interaction. The S:C (scope changed) designation indicates the vulnerability crosses trust boundaries — the RSLinx service crash can impact the broader OT control system it bridges, not just the host process.

RSLinx Classic occupies a critical position in many Rockwell-based architectures. It serves as the communication gateway between engineering workstations, HMI/SCADA systems, and PLCs on EtherNet/IP networks. When RSLinx goes down, operators lose visibility and control connectivity — effectively blinding the process layer. In critical manufacturing environments, that loss of visibility can trigger automatic shutdowns or force operators into manual modes where human error risk increases.

The shift from CVSS v3.1 (8.6 High) to v4.0 (9.2 Critical) reflects the updated framework's better accounting for OT-specific impact — where availability is often the primary security objective and cross-domain effects matter more than confidentiality or integrity.

Who Is Most at Risk

Why This Matters More Than a Typical DoS Advisory
Critical manufacturing facilities running legacy Rockwell architectures with RSLinx Classic as the communications backbone
Discrete and process manufacturing sites where engineering workstations with RSLinx are exposed on plant floor networks
Environments with flat network architectures where plant floor networks are reachable from corporate or even internet-facing segments
Remote access setups where RSLinx-enabled workstations are reachable through VPNs or jump hosts without proper segmentation

Shield53 Recommendations: Immediate Actions

  1. Patch to version 4.60 immediately on all engineering workstations, HMI hosts, and any system running RSLinx Classic. Inventory every instance first — RSLinx is often installed as a bundled component with RSLogix/Studio 5000 and may exist on systems administrators don't track.
  2. Inventory and asset discovery: Use network scanning to identify all hosts with RSLinx Classic installed. Check Add/Remove Programs and the Rockwell installation directory for version strings.
  3. Network segmentation: Ensure CIP traffic (TCP/UDP 44818, 2222) is restricted to only trusted PLC and HMI peers. RSLinx should never be reachable from corporate networks or the internet. Implement IEC 62443 zone and conduit segmentation.
  4. Deploy deep packet inspection: OT-aware IPS/IDS solutions can detect and block malformed CIP packets targeting the Forward Close service and other vulnerable CIP paths identified in the advisory.
  5. Monitor for service crashes: Configure Windows Event Log monitoring for RSLinx service restart events. Repeated crashes may indicate reconnaissance or exploitation attempts preceding a larger attack.
  6. Apply Rockwell security best practices: If immediate upgrade is not possible, follow Rockwell's hardening guidance at their Trust Center, including disabling unnecessary CIP services and restricting access via host-based firewalls.
  7. Plan for legacy retirement: RSLinx Classic is a legacy product. Organizations should evaluate migration to FactoryTalk Linx, the modern successor, as part of their OT modernization roadmap.

These vulnerabilities underscore a persistent challenge in OT security: critical communication utilities often outlive their vendor's active development focus, leaving manufacturing environments running unsupported or under-supported software for years. The availability of a patch is good news — but only for organizations that know they have the software and can schedule the downtime to fix it. Start with inventory; everything else flows from knowing what you have.