Quick answers
- Is CVE-2026-9622 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9622 being exploited in the wild.
- How severe is CVE-2026-9622?
- Informational severity, with a CVSS score of 9.2, published 1 September 2026.
- Which products and versions are affected?
- Rockwell Automation RSLinx Classic V4.50 and prior.
- Is there a fix for CVE-2026-9622?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-9622 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-9622?
- Check whether you run Rockwell Automation RSLinx Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer underflow vulnerability (CWE-191) exists in RSLinx Classic's handling of the Forward Close service within the Common Industrial Protocol (CIP). An attacker can send a specially crafted CIP packet to trigger an integer underflow condition, causing the RSLinx Classic service to crash. No authentication is required and the vulnerability is network-reachable. An attacker can achieve denial-of-service by causing service unavailability, requiring manual restart to recover. The vulnerability is fixed in version 4.60; affected versions are 4.50 and prior.
Affected products
- Rockwell Automation RSLinx Classic V4.50 and prior
Timeline
- 2026-09-01: disclosed