CVE-2026-9636
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. The following versions of Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module are affected: ControlLogix 5580 >=V36|<=V37 (CVE-2026-9636) CompactLogix 5380 >=V36|<=V37 (CVE-2026-9636) GuardLogix 5580 >=V36|<=V37 (CVE-2026-9636) Compact GuardLogix 5380 >=V36|<=V37 (CVE-2026-9636) 1756-EN4TR V6.001 (CVE-2026-9636) 1756-EN4TR V7.001 (CVE-2026-9636) CVSS Vendor Equipment Vulnerabilities v3 5.9 Rockwell Automation Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module Improper Check for Certificate Revocation Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-9636 A security issue exists within CompactLogix 5380, ControlLogix 5580, and EN4TR communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections. View CVE Details Affected Products Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module Vendor: Rockwell Automation Product Version: Rockwell Automation ControlLogix 5580: >=V36|<=V37, Rockwell Automation CompactLogix 5380: >=V36|<=V37, Rockwell Automation GuardLogix 5580: >=V36|<=V37, Rockwell Automation Compact GuardLogix 5380: >=V36|<=V37, Rockwell Automation 1756-EN4TR: V6.001, Rockwell Automation 1756-EN4TR: V7.001 Product Status: known_affected Remediations Vendor fix Rockwell Automation recommend users update to the following versions: Con
CSIRTS triage
- What
- A vulnerability could cause a denial-of-service condition.
- Who is affected
- Users of Rockwell Automation CompactLogix 5380, ControlLogix 5580, and 1756-EN4TR modules within the specified version range.
- Urgency
- Remediation is critical due to the potential for denial-of-service attacks.
- Action
- Update the affected modules to versions outside the specified range.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-9636
Get an email if CVE-2026-9636 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
Advisory coverage (3)
- criticalRockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Modulecisa · 2026-07-30
- high[NEW] [high] Rockwell Automation CompactLogix and ControlLogix: Multiple vulnerabilitiescert-bund · 2026-07-17
- unknownCVE-2026-9636: A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication mo…nvd · 2026-07-14
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-9636)