CVE-2026-9307
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition. The following versions of Rockwell Automation CompactLogix are aff...
Affects 0 products across 1 vendor.
Rockwell Automation CompactLogix 5370 series PLCs (L1, L2, L3) are affected by two vulnerabilities: Improper Validation of Integrity Check Value and Exposure of Sensitive System Information to an Unauthorized Control Sphere, both carrying a CVSS v3 score of 7.5. A remote attacker can exploit these flaws to cause a denial-of-service condition, potentially halting industrial control processes. In OT environments, a successful DoS against these PLCs could result in loss of control over physical processes, production downtime, and safety risks depending on the controlled system.
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-9307?
Is CVE-2026-9307 actively exploited?
How do I remediate CVE-2026-9307?
What systems are affected by CVE-2026-9307?
| CVE ID | CVE-2026-9307 |
|---|---|
| Published | 2026-06-16 |
| Last Modified | 2026-06-16 |
| ICS Relevance | 65% |
| Weakness (CWE) | |
| Source | NVD |
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition. The following versions of Rockwell Automation CompactLogix are affected: CompactLogix 5370 L1 CompactLogix 5370 L2 CompactLogix 5370 L3 CVSS Vendor Equipment Vulnerabilities v3 7.5 Rockwell Automation Rockwell Automation CompactLogix Improper Validation of Integrity Check Value, Exposure of Sensitive System Information to an Unauthorized Control Sphere Background Cri
Source: NIST NVD / MITRE CVE Database
| Vendor | Product | Fixed Version |
|---|---|---|
| Rockwell Automation | — | — |
Vendor patch expected to add proper integrity check validation for incoming CIP messages and restrict exposure of sensitive system information over the EtherNet/IP interface; specific fixed firmware version not yet publicly disclosed at time of analysis.
View Vendor Advisory →| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Deploy the virtual patch rule on IDS/IPS sensors positioned inline or in monitoring mode on all network segments containing CompactLogix 5370 PLCs. Block all inbound EtherNet/IP (TCP/UDP port 44818 and UDP port 2222) traffic from any source not explicitly whitelisted as an authorized engineering workstation or SCADA server. Additionally, block all outbound CIP traffic from PLCs to untrusted networks at the iDMZ firewall. Implement strict allowlist-based ACLs on managed switches serving the OT LAN.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.
Join free →