Quick answers
- Is CVE-2026-84235 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84235 being exploited in the wild.
- How severe is CVE-2026-84235?
- Informational severity, with a CVSS score of 8.7, published 1 September 2026.
- Which products and versions are affected?
- Rockwell Automation 1756-ENBT all versions; Rockwell Automation 1756-EWEB all versions; Rockwell Automation L3xX all versions.
- Is there a fix for CVE-2026-84235?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-84235 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-84235?
- Check whether you run Rockwell Automation 1756-ENBT, Rockwell Automation 1756-EWEB or Rockwell Automation L3xX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a denial-of-service vulnerability in the CIP packet parsing logic of the 1756-ENBT module. A remote attacker can send a malformed CIP packet over the network to trigger a crash in the affected device, which requires manual intervention to restart. The vulnerability affects all firmware versions of the 1756-ENBT, 1756-EWEB, and L3xX catalog numbers. No permanent fix has been released; Rockwell Automation recommends upgrading to the 1756-EN2T or 1756-EN4TR modules as a replacement, or implementing network-based security controls as a workaround.
Affected products
- Rockwell Automation 1756-ENBT all versions
- Rockwell Automation 1756-EWEB all versions
- Rockwell Automation L3xX all versions
Timeline
- 2026-09-01: disclosed
- 2026-09-01: advisory: Rockwell Automation SD1798