CVE-2026-9636: Rockwell Automation CompactLogix® 5380 ControlLogix® 5580 / 1756-EN4 Communications Module – Certificate Revocation List Vulnerability
A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rockwell Automation CompactLogix 5380 / ControlLogix 5580 / 1756-EN4 Communications Moduleto a version that resolves this vulnerability.Fixed in 8.001 or later - Upgrade
Upgrade
Rockwell Automation CompactLogix 5380 / ControlLogix 5580 / 1756-EN4 Communications Moduleto a version that resolves this vulnerability.Fixed in 38.011 or later
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9636?
CVE-2026-9636 has a high severity rating of 8.2 according to the CVSS score.
How do I fix CVE-2026-9636?
To fix CVE-2026-9636, update Rockwell Automation CompactLogix 5380, ControlLogix 5580, or 1756-EN4 modules to the latest patched version provided by Rockwell Automation.
What systems are affected by CVE-2026-9636?
CVE-2026-9636 affects Rockwell Automation CompactLogix 5380, ControlLogix 5580, and 1756-EN4 Communications Modules.
What type of vulnerability is CVE-2026-9636?
CVE-2026-9636 is a security vulnerability related to improper certificate revocation handling in specific Rockwell Automation communication modules.
What are the potential risks of CVE-2026-9636?
The potential risks of CVE-2026-9636 include unauthorized access to critical control systems due to improperly handled revoked certificates.