Is CVE-2026-11317 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11317 being exploited in the wild.

How severe is CVE-2026-11317?

Informational severity, with a CVSS score of 8.7, published 16 June 2026.

Which products and versions are affected?

Rockwell Automation Compact GuardLogix 5370 Prior to 34.016, 35.015, 36.012; Rockwell Automation CompactLogix 5370 Prior to 34.016, 35.015, 36.012; Rockwell Automation ControlLogix 5570 Prior to 34.016, 35.015, 36.012; Rockwell Automation GuardLogix 5570 Prior to 34.016, 35.015, 36.012.

Is there a fix for CVE-2026-11317?

A patch was published on 2026-06-16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11317 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-11317?

Check whether you run Rockwell Automation Compact GuardLogix 5370, Rockwell Automation CompactLogix 5370, Rockwell Automation ControlLogix 5570 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11317: Rockwell Automation Logix Controllers denial of service via CIP message

CVE-2026-11317 · Severity: info · CVSS 8.7 · Published 2026-06-16

Rockwell Automation Logix controllers, which are used to manage industrial machinery and automation processes, are vulnerable to a denial-of-service attack. An attacker can send a specially crafted network message that causes the controller to crash into a 'Major Non-Recoverable Fault' state. This results in an immediate halt of industrial operations and requires a manual program reload to restore service, potentially leading to significant production downtime.

Vendors: Rockwell Automation.

Quick answers

Is CVE-2026-11317 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11317 being exploited in the wild.
How severe is CVE-2026-11317?: Informational severity, with a CVSS score of 8.7, published 16 June 2026.
Which products and versions are affected?: Rockwell Automation Compact GuardLogix 5370 Prior to 34.016, 35.015, 36.012; Rockwell Automation CompactLogix 5370 Prior to 34.016, 35.015, 36.012; Rockwell Automation ControlLogix 5570 Prior to 34.016, 35.015, 36.012; Rockwell Automation GuardLogix 5570 Prior to 34.016, 35.015, 36.012.
Is there a fix for CVE-2026-11317?: A patch was published on 2026-06-16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11317 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-11317?: Check whether you run Rockwell Automation Compact GuardLogix 5370, Rockwell Automation CompactLogix 5370, Rockwell Automation ControlLogix 5570 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service vulnerability exists in Rockwell Automation Logix 5370 and 5570 controllers due to improper resource handling (CWE-404) when processing Common Industrial Protocol (CIP) messages. An unauthenticated remote attacker can send a crafted CIP message over the network to trigger a Major Non-Recoverable Fault (MNRF). Devices with lower memory specifications are reported to be more susceptible to this condition. Once the fault occurs, the controller stops executing its logic, and recovery requires a fresh program download. Firmware updates (versions 34.016, 35.015, 36.012, 37.011 and later) have been released to address the issue.

Affected products

Rockwell Automation CompactLogix 5370 Prior to 34.016, 35.015, 36.012
Rockwell Automation Compact GuardLogix 5370 Prior to 34.016, 35.015, 36.012
Rockwell Automation ControlLogix 5570 Prior to 34.016, 35.015, 36.012
Rockwell Automation GuardLogix 5570 Prior to 34.016, 35.015, 36.012

Timeline

2026-06-16: disclosed
2026-06-16: advisory
2026-06-16: patched

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1772.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.