As reported by CISA in advisory ICSA-26-244-03, Rockwell Automation has disclosed a high-severity denial-of-service vulnerability affecting four of its most widely deployed programmable logic controller (PLC) families. The flaw, tracked as CVE-2026-9637 with a CVSS v3 score of 7.5, stems from improper input length validation during Common Industrial Protocol (CIP) message processing — the backbone communication protocol for Allen-Bradley control systems.
What elevates this beyond a routine OT patch is the major nonrecoverable fault (MNRF) impact. Exploitation doesn't merely disrupt communications; it crashes the controller firmware entirely, requiring a physical power cycle to restore operation. In a continuous manufacturing environment, that translates to unplanned downtime measured in hours, not minutes — and in regulated industries, potentially scrapped product batches and safety system impairments.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-9637 |
| CVSS v3 | 7.5 (High) |
| CWE | Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) |
| Impact | Denial-of-service via MNRF; physical power cycle required |
| Vector | Network — crafted CIP message |
| Affected Families | ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380 |
| Affected Versions | <=V33, V34.011–V34.014, V35.011–V35.013, V36.011–V36.012 |
| Patch | Firmware V37.011 (vendor fix available) |
| Active Exploitation | Not confirmed in the wild at time of advisory |
Why This Matters for OT Defenders
The inclusion of GuardLogix and Compact GuardLogix in the affected list is the most concerning detail that may be overlooked. These are Rockwell's safety-integrated controllers — the systems responsible for emergency shutdowns, machine guarding, and process safety interlocks. While a DoS on a safety controller does not directly compromise the safety logic, an unresponsive safety PLC can trigger fail-safe shutdowns across an entire production cell, compounding the operational impact far beyond the initially targeted device.
The attack surface is also broader than it appears. CIP messaging operates over EtherNet/IP, which in many deployments is routable across plant networks. Any host that can reach TCP port 44818 to a vulnerable controller is a potential attack source. This includes compromised engineering workstations, bridged VLANs, and — increasingly — IT/OT convergence zones where segmentation is incomplete.
A single malformed CIP packet can take a critical manufacturing line offline indefinitely. In OT, availability IS the security objective — and this vulnerability strikes directly at it.
Who Is Most Exposed
- Critical manufacturing facilities running Rockwell 5580/5380-series controllers on unpatched firmware
- Discrete and process manufacturing with flat network architectures lacking IT/OT segmentation
- Safety-critical environments deploying GuardLogix controllers where MNRF events trigger cascading shutdowns
- Facilities with remote access to PLCs via vendor maintenance tunnels or jump hosts without CIP-aware filtering
Shield53 Recommendations
Immediate Actions
Longer-Term Posture
Firmware vulnerability management in OT remains chronically under-resourced. Organizations should establish a quarterly PLC firmware review cycle, integrate Rockwell's security advisory RSS feeds into the vulnerability management pipeline, and ensure that maintenance windows are contractually guaranteed with operations leadership — not treated as optional. The gap between advisory publication and field patching in industrial environments routinely exceeds 90 days; for a 7.5-rated DoS on safety controllers, that window is unacceptable.
