# CVE-2026-9624: Rockwell Automation RSLinx Classic denial-of-service via malformed CIP packet

Source: https://junglewise.ai/threats/cve-2026-9624-rockwell-automation-rslinx-classic-denial-of-service-via-malformed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-9624 · Severity: info · CVSS 8.7 · Published 2026-09-01

RSLinx Classic is industrial communications software used by manufacturing and automation facilities to connect Allen-Bradley devices to control systems. A specially crafted network packet can crash the RSLinx service, forcing manual restart and causing temporary loss of real-time monitoring and device connectivity in critical automation environments.

Technologies: [Rockwell Automation RSLinx Classic](https://junglewise.ai/threats/technologies/rslinx-classic). Vendors: [Rockwell Automation](https://junglewise.ai/threats/vendors/rockwell-automation).

## Quick answers

**Is CVE-2026-9624 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9624 being exploited in the wild.

**How severe is CVE-2026-9624?** Informational severity, with a CVSS score of 8.7, published 1 September 2026.

**Which products and versions are affected?** Rockwell Automation RSLinx Classic V4.50 and prior.

**Is there a fix for CVE-2026-9624?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9624 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-9624?** Check whether you run Rockwell Automation RSLinx Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a denial-of-service condition triggered by insufficient validation of data length in CIP (Common Industrial Protocol) packets processed by RSLinx Classic. The root cause is an integer underflow in packet parsing that occurs when a malformed CIP packet with inadequate length fields is received. An attacker with network access to the RSLinx service can send a crafted CIP packet to trigger a service crash; no authentication is required. The impact is service unavailability requiring manual restart. Patches are available in version 4.60 and later.

## Affected products

- Rockwell Automation RSLinx Classic V4.50 and prior

## Timeline

- 2026-09-01: disclosed

## References

- [https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html](https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1794.html)

## Related threats

- [Rockwell Automation RSLinx Classic denial-of-service in CIP packet handling](https://junglewise.ai/threats/cve-2026-9625-rockwell-automation-rslinx-classic-denial-of-service-in-cip-packet)
- [Rockwell Automation RSLinx Classic denial-of-service in Forward Close service](https://junglewise.ai/threats/cve-2026-9622-rockwell-automation-rslinx-classic-denial-of-service-in-forward)
- [Rockwell Automation RSLinx Classic denial-of-service via malformed CIP packet](https://junglewise.ai/threats/cve-2026-9621-rockwell-automation-rslinx-classic-denial-of-service-via-malformed)