CVE-2021-22681
Actively exploited. CVE-2021-22681 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-03-05) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
CSIRTS triage
- What
- The vulnerability allows an unauthorized application to connect with Logix controllers due to insufficiently protected credentials.
- Who is affected
- Users with network access to Rockwell products are affected by this vulnerability.
- Urgency
- Remediation is critical as the vulnerability is actively exploited and poses significant risks.
- Action
- Implement security measures and update Rockwell products to the latest versions.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2021-22681
Get an email if CVE-2021-22681 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 98% of all EPSS-scored CVEs.
Advisory coverage (1)
- criticalexploitedCVE-2021-22681: Rockwell Multiple Products Insufficient Protected Credentials Vulnerabilitycisa-kev · 2026-03-05
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2021-22681)