CVE-2026-9653Active Exploitation

MEDIUMCVSS 8.7 · HIGH

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1780.html

Weakness type (CWE)

CWE-354

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Active Exploitation

150.0%

Patch

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Windows Forum@windowsforum91d
Patch
⚠️ Rockwell’s ControlLogix fix is simple—update EN2/EN3 to V12.002. ENBT owners get the classic “unsupported, good luck” treatment. One DoS bug, three module families, zero room for patch procrastination. https://windowsforum.com/threads/cve-2026-9653-update-controllogix-en2-en3-to-v12-002.438955/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #RockwellAutomation #Controllogix #OtCybersecurity https://t.co/2ED3mzbf9R
Post summary
Rockwell Automation recommends updating ControlLogix firmware to V12.002 to mitigate a DoS vulnerability affecting multiple module families.
0000012
1.3K followersView on X
Aviatrix Threat Research Center@aviatrixtrc91d
Active Exploitation
Attackers exploited CVE-2026-9653 in Rockwell Automation modules by sending crafted CIP packets to trigger continuous denial-of-service conditions. While devices auto-recover, repeated exploitation causes significant operational downtime in industrial environments. #Vulnerability 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/icsa-26-197-02-cve-2026-9653
Post summary
Attackers are actively exploiting CVE‑2026‑9653 on Rockwell Automation modules by sending crafted CIP packets to cause continuous DoS, leading to significant downtime in industrial environments; no patch or mitigation details are provided.
0000053
1.9K followersView on X

Explore more

Back to dashboard