Is CVE-2026-12659 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12659 being exploited in the wild.

How severe is CVE-2026-12659?

Informational severity, with a CVSS score of 8.7, published 14 July 2026.

Is there a fix for CVE-2026-12659?

A patch was published on 2026-07-14: Fixed in version 6.012 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12659 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-12659?

Check whether you run Rockwell Automation FLEX 5000 EtherNet/IP Adapter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12659: Rockwell Automation FLEX 5000 Adapter denial of service via crafted CIP packets

CVE-2026-12659 · Severity: info · CVSS 8.7 · Published 2026-07-14

Rockwell Automation FLEX 5000 EtherNet/IP Adapters are used to connect industrial I/O modules to automation networks. A security vulnerability has been identified that allows a remote attacker to crash the adapter, causing a total loss of communication and control over the connected industrial equipment. Recovering from this state requires a physical power cycle of the hardware, which could lead to significant operational downtime in manufacturing or utility environments.

Vendors: Rockwell Automation.

Quick answers

Is CVE-2026-12659 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12659 being exploited in the wild.
How severe is CVE-2026-12659?: Informational severity, with a CVSS score of 8.7, published 14 July 2026.
Which products and versions are affected?: Rockwell Automation FLEX 5000 EtherNet/IP Adapter 6.011.
Is there a fix for CVE-2026-12659?: A patch was published on 2026-07-14: Fixed in version 6.012 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12659 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-12659?: Check whether you run Rockwell Automation FLEX 5000 EtherNet/IP Adapter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service (DoS) vulnerability exists in the Rockwell Automation FLEX 5000 EtherNet/IP Adapter firmware version 6.011. The issue is classified as a double-free vulnerability (CWE-415) triggered by improper handling of exceptional conditions during the processing of specially crafted Common Industrial Protocol (CIP) packets. An unauthenticated attacker can send these packets over the network to cause the adapter to enter a non-responsive state. Recovery of the module and its associated I/O requires a manual power cycle. The vulnerability is addressed in firmware version 6.012.

Affected products

Rockwell Automation FLEX 5000 EtherNet/IP Adapter 6.011

Timeline

2026-07-14: disclosed
2026-07-14: advisory
2026-07-14: patched: Fixed in version 6.012

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1789.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.