Is CVE-2026-9653 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9653 being exploited in the wild.

How severe is CVE-2026-9653?

Informational severity, with a CVSS score of 8.7, published 14 July 2026.

Which products and versions are affected?

Rockwell Automation 1756-EN2 V12.001 and before; Rockwell Automation 1756-EN3 V12.001 and before; Rockwell Automation 1756-ENBT V6.006.

Is there a fix for CVE-2026-9653?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9653 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-9653?

Check whether you run Rockwell Automation 1756-EN2, Rockwell Automation 1756-EN3 or Rockwell Automation 1756-ENBT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9653: Rockwell Automation 1756-EN series denial of service in CIP packets

CVE-2026-9653 · Severity: info · CVSS 8.7 · Published 2026-07-14

Rockwell Automation ControlLogix communication modules are vulnerable to a flaw that allows a remote attacker to disrupt industrial network connections. By sending specially crafted data packets, an attacker can cause a denial-of-service condition, temporarily disconnecting the module from the industrial network. While the device is designed to recover immediately, repeated attacks could lead to sustained operational downtime and loss of visibility into industrial processes.

Vendors: Rockwell Automation.

Quick answers

Is CVE-2026-9653 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9653 being exploited in the wild.
How severe is CVE-2026-9653?: Informational severity, with a CVSS score of 8.7, published 14 July 2026.
Which products and versions are affected?: Rockwell Automation 1756-EN2 V12.001 and before; Rockwell Automation 1756-EN3 V12.001 and before; Rockwell Automation 1756-ENBT V6.006.
Is there a fix for CVE-2026-9653?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9653 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-9653?: Check whether you run Rockwell Automation 1756-EN2, Rockwell Automation 1756-EN3 or Rockwell Automation 1756-ENBT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in the Rockwell Automation 1756-EN2, EN3, and ENBT communication modules due to improper validation of Common Industrial Protocol (CIP) Implicit Connection packets (CWE-354). A remote, unauthenticated attacker can exploit this by sending crafted packets over the network to the affected module. Successful exploitation results in the disruption of device connections, although the module is reported to recover immediately after the packet is processed. Firmware version V12.002 provides a fix for EN2 and EN3 modules; however, the ENBT module is discontinued and will not receive a patch.

Affected products

Rockwell Automation 1756-EN2 V12.001 and before
Rockwell Automation 1756-EN3 V12.001 and before
Rockwell Automation 1756-ENBT V6.006

Timeline

2026-07-14: advisory: Initial release of Rockwell Automation advisory SD1780
2026-07-14: disclosed

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1780.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.