CISA published ICS advisories ICSA-26-244-01 and ICSA-26-244-03 for Rockwell Automation products, both with a release date of 1 September 2026. ICSA-26-244-01 covers RSLinx Classic version 4.50 and earlier: four vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) let a crafted CIP packet crash the RSLinx Classic service, which then has to be restarted; CVE-2026-9621 and CVE-2026-9622 are rated CVSS 3.1 8.6 (High) and CVSS 4.0 9.2 (Critical), and the other two CVSS 3.1 7.5 and CVSS 4.0 8.7; the fix is version 4.60.

ICSA-26-244-03 covers CVE-2026-9637 (CWE-119) in ControlLogix 5580, CompactLogix 5380, GuardLogix 5580 and Compact GuardLogix 5380 controllers at V33 and earlier, V34.011 to V34.014, V35.011 to V35.013 and V36.011 to V36.012, where exploitation causes a major nonrecoverable fault (MNRF) that needs a power cycle; it is rated CVSS 3.1 7.5 and CVSS 4.0 8.7, with fixes in V37.011, V34.015, V35.014 and V36.013.

For both advisories CISA says no known public exploitation specifically targeting these vulnerabilities has been reported to it. (source: CISA)

Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; this card now covers only the two CISA advisories we have read (it previously listed other Rockwell products from SecurityWeek), and the card date moves from 2 to 1 September 2026, the CISA release date. (source: CISA)