VulnSocial

CVE-2026-9636Active Exploitation

LOWCVSS 8.2 · HIGH

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-299

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-09-01)
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-31: 1Mentions · 2026-09-01: 2Active Exploitation · 2026-07-31: 1Technical Details · 2026-07-31: 1Technical Details · 2026-09-01: 107-3109-01
Signal classification3 categories
Active Exploitation
133.3%
Disclosure
133.3%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-311
Active Exploitation1
2026-09-012
Disclosure1General1
Full discourse3 posts
  • Ryx@PadhiyarRushi
    Disclosure

    🚨 NEW ICS ADVISORY: CVE-2026-9636 CISA issued advisory ICSA-26-211-05 covering an authentication bypass vulnerability in Rockwell Automation Logix controllers and 1756-EN4TR communication modules. If you use CIP Security, read this breakdown 🧵👇

    Post summary

    CISA has released an advisory (ICSA-26-211-05) for CVE‑2026‑9636, exposing an authentication bypass flaw in Rockwell Automation Logix controllers and 1756‑EN4TR communication modules. The advisory highlights the vulnerability but does not mention active exploitation, patches, or a PoC.

    10021261
    953 followersView on X
  • Ryx@PadhiyarRushi
    General

    🔗 Official Sources & Verified Reports • CISA Advisory (ICSA-26-211-05): https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-05 • Rockwell Security Advisory SD1788 https://www.sentinelone.com/vulnerability-database/cve-2026-9636

    Post summary

    The post merely cites official advisory links for CVE‑2026‑9636, offering no further technical or exploitation details.

    1001055
    572 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    Attackers exploited CVE-2026-9636 in Rockwell Automation controllers to bypass certificate validation and establish unauthorized connections. TRC analysis shows lateral movement within industrial networks, demonstrating how certificate flaws can compromise entire OT environments. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/icsa-26-211-05-cve-2026-9636

    Post summary

    Attackers leveraged CVE‑2026‑9636 to bypass certificate validation on Rockwell Automation controllers, enabling unauthorized connections and lateral movement across industrial networks, as confirmed by the linked threat analysis.

    0000075
    1.9K followersView on X

Explore more

Back to dashboard