Rockwell Automation RSLinx Classic Crashes on Malformed CIP Packet Due to Integer Overflow, Requiring Manual Service Restart

Last refreshed2026-10-07

Status: UPDATED | Advisory ID: CVE-2026-9621

Key Details

CVE	CVE-2026-9621
CVSS Score / Version	9.2 (Critical) / CVSS v4.0
Updated	2026-09-01
Affected products	Rockwell Automation RSLinx Classic®
Classified as	CWE-190 (Integer Overflow or Wraparound)
Exploitation prediction (EPSS)	0.43% probability of exploitation in the next 30 days (35% percentile) -- FIRST.org's EPSS model.

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
Rockwell Automation	RSLinx Classic®

Vendor

Product

Affected Versions

Patch Status

Rockwell Automation

RSLinx Classic®

Subsystems	General OT
Sectors	Multiple

What to Know

A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover (NVD)

What to Do

Monitor Rockwell Automation's web page for any future patch releases.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-9621
CVE	https://www.cve.org/CVERecord?id=CVE-2026-9621

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-9621

CVE