[NEW] [medium] Rockwell Automation ControlLogix 5580, CompactLogix 5380, and CompactLogix 5480: Multiple vulnerabilities enable denial of service

CSIRTS triage

What

Multiple vulnerabilities allow remote attackers to perform denial-of-service attacks against industrial controllers.

Who is affected

Deployments of ControlLogix 5580, CompactLogix 5380, and CompactLogix 5480 on networks with remote access are vulnerable.

Urgency

Medium severity; denial-of-service exposure in critical infrastructure requires timely remediation.

Action

Apply Rockwell Automation security patches to affected controller firmware versions.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

medium

Published

2026-09-02

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3142

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Moderate exploitation riskCVE-2021-422603.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 88% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownCVE-2026-9637: A denial-of-service security issue exists in the affected Logix platforms listed in the table a…nvd
• criticalRockwell Automation Logix Platformcisa
• criticalRockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogixcisa

Recent advisories for Rockwell Automation ControlLogix

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• criticalRockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogixcisa · 2026-09-01
• criticalRockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Modulecisa · 2026-07-30
• high[NEW] [high] Rockwell Automation CompactLogix and ControlLogix: Multiple vulnerabilitiescert-bund · 2026-07-17
• unknownRockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogixcisa · 2026-07-16

More from CERT-Bund (BSI) Security Advisories

• critical[NEW] [high] JFrog Artifactory: Vulnerability allows obtaining administrator privileges2026-09-03
• high[NEW] [high] Golang Go: Multiple vulnerabilities2026-09-02
• high[UPDATE] [high] Golang Go: Multiple vulnerabilities2026-09-02
• medium[NEW] [medium] Node.js: Multiple vulnerabilities2026-09-02
• critical[NEW] [critical] SonicWall SMA: Multiple vulnerabilities2026-09-02