Is CVE-2026-8312 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8312 being exploited in the wild.

How severe is CVE-2026-8312?

Informational severity, with a CVSS score of 7.8, published 14 July 2026.

Which products and versions are affected?

Rockwell Automation Arena Simulation V17.00.00 and prior.

Is there a fix for CVE-2026-8312?

A patch was published on 2026-07-14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8312 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-8312?

Check whether you run Rockwell Automation Arena Simulation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8312: Rockwell Automation Arena Simulation out-of-bounds write in expmt.exe

CVE-2026-8312 · Severity: info · CVSS 7.8 · Published 2026-07-14

Rockwell Automation Arena Simulation, a software tool used to model and optimize complex industrial systems, is affected by a memory corruption vulnerability. An attacker could exploit this by tricking a user into opening a specially crafted malicious file. Successful exploitation could allow the attacker to take control of the user's system, potentially leading to data theft or disruption of simulation operations.

Technologies: Rockwell Automation Arena Simulation. Vendors: Rockwell Automation.

Quick answers

Is CVE-2026-8312 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8312 being exploited in the wild.
How severe is CVE-2026-8312?: Informational severity, with a CVSS score of 7.8, published 14 July 2026.
Which products and versions are affected?: Rockwell Automation Arena Simulation V17.00.00 and prior.
Is there a fix for CVE-2026-8312?: A patch was published on 2026-07-14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8312 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-8312?: Check whether you run Rockwell Automation Arena Simulation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory corruption vulnerability exists in the expmt.exe (Siman) component of Rockwell Automation Arena Simulation due to improper validation of user-supplied data. This flaw results in an out-of-bounds write (CWE-787). The attack vector is local and requires user interaction, specifically convincing a user to open a malicious file. If successfully exploited, an attacker can execute arbitrary code in the context of the current process. The vulnerability is addressed in version V17.00.01.

Affected products

Rockwell Automation Arena Simulation V17.00.00 and prior

Timeline

2026-07-14: disclosed
2026-07-14: advisory
2026-07-14: patched

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1784.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.