CVE-2026-9636

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9636", "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0", "state": "PUBLISHED", "assignerShortName": "Rockwell", "dateReserved": "2026-05-26T18:10:55.329Z", "datePublished": "2026-07-14T15:11:42.995Z", "dateUpdated": "2026-07-14T15:55:05.004Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b73dd486-f505-4403-b634-40b078b177f0", "shortName": "Rockwell", "dateUpdated": "2026-07-14T15:11:42.995Z"}, "title": "Rockwell Automation CompactLogix\u00ae 5380 ControlLogix\u00ae 5580 / 1756-EN4 Communications Module \u2013 Certificate Revocation List Vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-299", "description": "CWE-299 Improper check for certificate revocation", "type": "CWE"}]}], "affected": [{"vendor": "Rockwell Automation", "product": "ControlLogix\u00ae 5580, CompactLogix\u00ae 5380, GuardLogix\u00ae 5580, Compact GuardLogix\u00ae 5380, 1756-EN4TR", "versions": [{"status": "affected", "version": "Version 36 - Version 37"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A security issue exists within CompactLogix\u00ae 5380, ControlLogix\u00ae 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A security issue exists within CompactLogix\u00ae 5380, ControlLogix\u00ae 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections."}]}], "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1788.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to firmware version 38.011 or later.\n\nFor\u00a01756-EN4TR upgrade to version 8.001 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to firmware version 38.011 or later.<br><br>For&nbsp;1756-EN4TR upgrade to version 8.001 or later."}]}], "source": {"advisory": "SD1788", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T15:54:57.625184Z", "id": "CVE-2026-9636", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T15:55:05.004Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9636", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T15:54:57.625184Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T15:55:00.563Z"}}], "cna": {"title": "Rockwell Automation CompactLogix\u00ae 5380 ControlLogix\u00ae 5580 / 1756-EN4 Communications Module \u2013 Certificate Revocation List Vulnerability", "source": {"advisory": "SD1788", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Rockwell Automation", "product": "ControlLogix\u00ae 5580, CompactLogix\u00ae 5380, GuardLogix\u00ae 5580, Compact GuardLogix\u00ae 5380, 1756-EN4TR", "versions": [{"status": "affected", "version": "Version 36 - Version 37"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to firmware version 38.011 or later.\n\nFor\u00a01756-EN4TR upgrade to version 8.001 or later.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to firmware version 38.011 or later.<br><br>For&nbsp;1756-EN4TR upgrade to version 8.001 or later.", "base64": false}]}], "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1788.html"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "A security issue exists within CompactLogix\u00ae 5380, ControlLogix\u00ae 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections.", "supportingMedia": [{"type": "text/html", "value": "A security issue exists within CompactLogix\u00ae 5380, ControlLogix\u00ae 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-299", "description": "CWE-299 Improper check for certificate revocation"}]}], "providerMetadata": {"orgId": "b73dd486-f505-4403-b634-40b078b177f0", "shortName": "Rockwell", "dateUpdated": "2026-07-14T15:11:42.995Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9636", "state": "PUBLISHED", "dateUpdated": "2026-07-14T15:55:05.004Z", "dateReserved": "2026-05-26T18:10:55.329Z", "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0", "datePublished": "2026-07-14T15:11:42.995Z", "assignerShortName": "Rockwell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ControlLogix\u00ae 5580, CompactLogix\u00ae 5380, GuardLogix\u00ae 5580, Compact GuardLogix\u00ae 5380, 1756-EN4TR", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "Version 36 - Version 37"}]}], "source": "PSIRT@rockwellautomation.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security issue exists within CompactLogix\u00ae 5380, ControlLogix\u00ae 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections."}, {"lang": "es", "value": "Existe un problema de seguridad en los m\u00f3dulos de comunicaci\u00f3n CompactLogix\u00ae 5380, ControlLogix\u00ae 5580 y EN4 relacionado con el manejo de revocaci\u00f3n de certificados de CIP Security. El problema de seguridad se origina en que el controlador no rechaza correctamente los certificados firmados por un certificado intermedio que ha sido revocado a trav\u00e9s de una Lista de Revocaci\u00f3n de Certificados (CRL). Esto podr\u00eda permitir a un atacante basado en red establecer una conexi\u00f3n utilizando un certificado que deber\u00eda ser no confiable, potencialmente eludiendo las protecciones de CIP Security."}], "id": "CVE-2026-9636", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "PSIRT@rockwellautomation.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9636", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T15:54:57.625184Z", "version": "2.0.3"}}]}, "published": "2026-07-14T16:17:05.860", "references": [{"source": "PSIRT@rockwellautomation.com", "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1788.html"}], "sourceIdentifier": "PSIRT@rockwellautomation.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-299"}], "source": "PSIRT@rockwellautomation.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "Version 36 - Version 37"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ControlLogix\u00ae 5580, CompactLogix\u00ae 5380, GuardLogix\u00ae 5580, Compact GuardLogix\u00ae 5380, 1756-EN4TR", "source": "cna", "vendor": "Rockwell Automation"}, "product": "1756-en4tr", "vendor": "rockwellautomation"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "Version 36 - Version 37"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": "ControlLogix\u00ae 5580, CompactLogix\u00ae 5380, GuardLogix\u00ae 5580, Compact GuardLogix\u00ae 5380, 1756-EN4TR", "source": "cna", "vendor": "Rockwell Automation"}, "product": "compact_guardlogix_5380", "vendor": "rockwellautomation"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "Version 36 - Version 37"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": "ControlLogix\u00ae 5580, CompactLogix\u00ae 5380, GuardLogix\u00ae 5580, Compact GuardLogix\u00ae 5380, 1756-EN4TR", "source": "cna", "vendor": "Rockwell Automation"}, "product": "compactlogix_5380", "vendor": "rockwellautomation"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "Version 36 - Version 37"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": "ControlLogix\u00ae 5580, CompactLogix\u00ae 5380, GuardLogix\u00ae 5580, Compact GuardLogix\u00ae 5380, 1756-EN4TR", "source": "cna", "vendor": "Rockwell Automation"}, "product": "controllogix_5580", "vendor": "rockwellautomation"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "Version 36 - Version 37"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": "ControlLogix\u00ae 5580, CompactLogix\u00ae 5380, GuardLogix\u00ae 5580, Compact GuardLogix\u00ae 5380, 1756-EN4TR", "source": "cna", "vendor": "Rockwell Automation"}, "product": "guardlogix_5580", "vendor": "rockwellautomation"}], "created": "2026-07-16T07:15:16.466722+00:00", "updated": "2026-11-11T01:15:05.423481+00:00", "vendors": ["rockwellautomation", "rockwellautomation$PRODUCT$1756-en4tr", "rockwellautomation$PRODUCT$compact_guardlogix_5380", "rockwellautomation$PRODUCT$compactlogix_5380", "rockwellautomation$PRODUCT$controllogix_5580", "rockwellautomation$PRODUCT$guardlogix_5580"]}