CVE-2026-0647
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access, account takeover, and cause loss of availability. The following versions of R...
Affects 0 products across 1 vendor.
Software does not perform any authentication for functionality that requires a verified identity.
Rockwell Automation FLEX I/O EtherNet/IP Adapters (1794-AENTR and 1794-AENTRXT, firmware V2.012) contain a memory management vulnerability (Missing Release of Memory) that can be exploited to cause loss of availability, unauthorized access, and account takeover. An attacker with network access to the EtherNet/IP adapter can trigger resource exhaustion, potentially crashing or destabilizing the device and disrupting industrial I/O operations. With a CVSS v3 score of 9.4, this is a critical-severity issue in OT environments where FLEX I/O adapters are commonly used in manufacturing and process control systems.
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-0647?
Is CVE-2026-0647 actively exploited?
How do I remediate CVE-2026-0647?
What systems are affected by CVE-2026-0647?
| CVE ID | CVE-2026-0647 |
|---|---|
| Published | 2026-06-16 |
| Last Modified | 2026-06-16 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Protocols | |
| Source | NVD |
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access, account takeover, and cause loss of availability. The following versions of Rockwell Automation FLEX I/O EtherNet/IP Adapters are affected: 1794-AENTR V2.012 (CVE-2026-0646, CVE-2026-0647) 1794-AENTRXT V2.012 (CVE-2026-0646, CVE-2026-0647) CVSS Vendor Equipment Vulnerabilities v3 9.4 Rockwell Automation Rockwell Automation FLEX I/O EtherNet/IP Adapters Missing Release of Memory
Source: NIST NVD / MITRE CVE Database
| Vendor | Product | Fixed Version |
|---|---|---|
| Rockwell Automation | — | — |
Vendor advisory references remediation for CVE-2026-0646 and CVE-2026-0647 affecting 1794-AENTR and 1794-AENTRXT V2.012; fixed firmware version not yet publicly confirmed. Monitor Rockwell Automation Security Advisory portal for updated firmware release.
View Vendor Advisory →| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Deploy rate-limiting and connection-count rules on EtherNet/IP TCP port 44818 and UDP port 2222 at the nearest network perimeter device (industrial firewall or managed switch) facing the FLEX I/O adapters. Block all inbound EtherNet/IP traffic from unauthorized source IPs, and alert on high-frequency connection attempts from any single source to the adapter. Place rules on industrial DMZ firewalls and IDPS sensors monitoring OT network segments.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.
Join free →