Is CVE-2025-11698 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-11698 being exploited in the wild.

How severe is CVE-2025-11698?

Informational severity, with a CVSS score of 9.2, published 14 July 2026.

Which products and versions are affected?

Rockwell Automation Compact GuardLogix 5380 Recovery Image before 1.072; Rockwell Automation CompactLogix 5380 Recovery Image before 1.072; Rockwell Automation CompactLogix 5480 Recovery Image before 1.072; Rockwell Automation ControlLogix 5580 Recovery Image before 1.072; and 1 more.

Is there a fix for CVE-2025-11698?

A patch was published on 2026-07-14: Corrected in boot firmware 1.072 and specific device firmware versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-11698 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2025-11698?

Check whether you run Rockwell Automation Compact GuardLogix 5380 Recovery Image, Rockwell Automation CompactLogix 5380 Recovery Image, Rockwell Automation CompactLogix 5480 Recovery Image or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-11698: Rockwell Automation Logix Controllers buffer overflow in boot firmware

CVE-2025-11698 · Severity: info · CVSS 9.2 · Published 2026-07-14

A vulnerability in the boot firmware of several Rockwell Automation industrial controllers could allow an attacker to crash the device. These controllers are used to manage complex industrial processes and safety systems. If exploited, the device enters a 'major non-recoverable fault,' requiring manual intervention and potentially causing significant downtime in manufacturing or utility operations.

Vendors: Rockwell Automation.

Quick answers

Is CVE-2025-11698 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-11698 being exploited in the wild.
How severe is CVE-2025-11698?: Informational severity, with a CVSS score of 9.2, published 14 July 2026.
Which products and versions are affected?: Rockwell Automation Compact GuardLogix 5380 Recovery Image before 1.072; Rockwell Automation CompactLogix 5380 Recovery Image before 1.072; Rockwell Automation CompactLogix 5480 Recovery Image before 1.072; Rockwell Automation ControlLogix 5580 Recovery Image before 1.072; and 1 more.
Is there a fix for CVE-2025-11698?: A patch was published on 2026-07-14: Corrected in boot firmware 1.072 and specific device firmware versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-11698 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2025-11698?: Check whether you run Rockwell Automation Compact GuardLogix 5380 Recovery Image, Rockwell Automation CompactLogix 5380 Recovery Image, Rockwell Automation CompactLogix 5480 Recovery Image or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in the boot firmware of Rockwell Automation Logix controllers. The vulnerability is triggered when a malicious user writes invalid file data to the controller, likely via the network or a local interface. This results in a Major Non-Recoverable Fault (MNRF), effectively a permanent denial-of-service state until the device is recovered. The issue specifically affects the boot firmware (the low-level software that loads the main operating system). A fix is available in boot firmware version 1.072 or later, which is automatically included in device firmware versions V36.013 and V37.011.

Affected products

Rockwell Automation CompactLogix 5380 Recovery Image before 1.072
Rockwell Automation Compact GuardLogix 5380 Recovery Image before 1.072
Rockwell Automation CompactLogix 5480 Recovery Image before 1.072
Rockwell Automation ControlLogix 5580 Recovery Image before 1.072
Rockwell Automation GuardLogix 5580 Recovery Image before 1.072

Timeline

2026-07-14: disclosed: Initial advisory release by Rockwell Automation
2026-07-14: patched: Corrected in boot firmware 1.072 and specific device firmware versions

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.