CVE-2026-9622: RSLinx Classic DoS Vulnerability

CVE-2026-9622 Overview

CVE-2026-9622 is a denial-of-service vulnerability in Rockwell Automation RSLinx Classic. A crafted Common Industrial Protocol (CIP) packet targeting the Forward Close service causes the RSLinx Classic service to crash. Recovery requires a manual restart of the service. The flaw is remotely exploitable over the network without authentication or user interaction. The underlying weakness is classified as an integer underflow [CWE-191].

RSLinx Classic provides communication between Rockwell programmable logic controllers (PLCs) and Windows-based engineering and human-machine interface (HMI) software. A service crash disrupts operator visibility and control across industrial environments.

Critical Impact
Unauthenticated remote attackers can crash the RSLinx Classic service with a single crafted CIP Forward Close packet, disrupting industrial communications until an operator manually restarts the service.

Affected Products

Rockwell Automation RSLinx Classic (see vendor advisory SD1794 for affected versions)

Discovery Timeline

2026-09-01 - CVE-2026-9622 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-9622

Vulnerability Analysis

The vulnerability affects the CIP Forward Close service handler in RSLinx Classic. CIP is the application-layer protocol used by EtherNet/IP to establish and tear down communication sessions between industrial devices. The Forward Close request instructs a target to release a previously established connection.

When RSLinx Classic parses a crafted Forward Close packet, an integer underflow condition [CWE-191] leads to abnormal program state and terminates the service process. Because the RSLinx Classic service acts as the communication broker between engineering workstations, HMIs, and PLCs, its termination severs all active sessions relying on the broker.

The attack is limited to availability. The advisory does not indicate memory corruption suitable for code execution, and the CVSS vector shows no impact to confidentiality or integrity.

Root Cause

The root cause is improper validation of length or count fields in the Forward Close request. An arithmetic operation on attacker-controlled values wraps below zero, producing a value that violates program assumptions. Subsequent processing enters an invalid state that crashes the service.

Attack Vector

An attacker sends a single crafted CIP Forward Close packet to a system running RSLinx Classic over TCP port 44818 or UDP port 2222, the standard EtherNet/IP ports. No credentials, prior session, or user interaction are required. Any host with network reachability to the RSLinx Classic listener can trigger the crash.

No verified public proof-of-concept code is available. Refer to the Rockwell Automation Security Advisory SD1794 for authoritative technical details.

Detection Methods for CVE-2026-9622

Indicators of Compromise

Unexpected termination of the RSLinx Classic Windows service (RsvcHost.exe) without operator action.
Windows Application or System event log entries showing an application crash for the RSLinx Classic process.
Loss of PLC communication for connected HMIs or engineering tools coinciding with inbound EtherNet/IP traffic.

Detection Strategies

Inspect EtherNet/IP traffic on TCP/44818 and UDP/2222 for malformed CIP Forward Close (service code 0x4E) requests with anomalous connection path or length fields.
Alert on RSLinx Classic service state transitions from Running to Stopped that are not preceded by an administrative action.
Correlate network flow spikes to the RSLinx host with subsequent process termination events on the endpoint.

Monitoring Recommendations

Forward Windows service, process, and network telemetry from RSLinx Classic hosts to a centralized analytics platform for correlation.
Baseline normal EtherNet/IP client populations and flag new external sources issuing CIP session teardown requests.
Monitor operational technology (OT) network segmentation boundaries for CIP traffic originating outside authorized engineering subnets.

How to Mitigate CVE-2026-9622

Immediate Actions Required

Apply the fixed version of RSLinx Classic identified in Rockwell Automation Security Advisory SD1794.
Restrict inbound EtherNet/IP traffic to RSLinx Classic hosts to known engineering workstations and PLCs only.
Verify that RSLinx Classic hosts are not directly reachable from enterprise IT networks or the internet.

Patch Information

Rockwell Automation has published Security Advisory SD1794 covering CVE-2026-9622. Consult the advisory for the list of affected versions and the corresponding fixed release. Apply the vendor-provided update on all systems running RSLinx Classic.

Workarounds

Place RSLinx Classic hosts behind an industrial firewall configured to permit CIP traffic only from authorized sources.
Enforce network segmentation between OT and IT zones per the ISA/IEC 62443 zone-and-conduit model.
Configure the Windows Service Control Manager to automatically restart the RSLinx Classic service on failure to shorten recovery time until patching is complete.

bash

# Example: configure automatic restart for the RSLinx Classic service on Windows
sc.exe failure "RSLinx Classic" reset= 86400 actions= restart/5000/restart/5000/restart/5000
sc.exe failureflag "RSLinx Classic" 1