VulnSocial

CVE-2026-12659General

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-415

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-16); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-16: 2Mentions · 2026-07-21: 1Patch / Workaround · 2026-07-16: 1Technical Details · 2026-07-16: 2Technical Details · 2026-07-21: 107-1607-21
Signal classification3 categories
General
133.3%
Patch
133.3%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-162
General1Patch1
2026-07-211
Disclosure1
Full discourse3 posts
  • BREACHSPIDER@breachspider
    Disclosure

    [Threat Brief] Rockwell Flex 5000 Adapter Double Free (CVE-2026-12659): DoS Against Distributed I/O https://breachspider.com/intel/2026-07-21-rockwell-flex-5000-adapter-double-free-cve-2026-12659-dos-ag #ICS #OTSecurity #SCADA #CriticalInfrastructure

    Post summary

    A threat brief highlights a double‑free flaw (CVE‑2026‑12659) in Rockwell Flex 5000 adapters that can cause a denial‑of‑service on distributed I/O, but no exploit code, patch, or evidence of active attacks are disclosed.

    0000046
    2.3K followersView on X
  • Windows Forum@windowsforum
    Patch

    🏭 One crafted CIP packet can knock a Flex 5000 Adapter offline—and recovery means a power cycle. “Have you tried turning the factory off and on?” Update 6.011 to 6.012. https://windowsforum.com/threads/cve-2026-12659-update-flex-5000-adapter-6-011-to-6-012.438947/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #RockwellAutomation #CipSecurity #Cve202612659 #Flex5000Adapter https://t.co/vbRfJpz10v

    Post summary

    CVE‑2026‑12659 enables a crafted CIP packet to crash a Flex 5000 Adapter, but Rockwell Automation has released update 6.012 to fix the issue.

    0000010
    1.3K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    General

    TRC analysis shows attackers can exploit CVE-2026-12659 to send crafted CIP packets against Rockwell Automation FLEX 5000 adapters. The vulnerability causes complete system lockup requiring physical power cycles to restore industrial operations. #ZeroDay 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/icsa-26-197-08-cve-2026-12659

    Post summary

    The analysis indicates attackers can exploit CVE-2026-12659 by sending crafted CIP packets to Rockwell Automation FLEX 5000 adapters, causing a complete system lockup that requires manual power cycling to recover.

    0000072
    1.9K followersView on X

Explore more

Back to dashboard