CVE-2026-9636: Rockwell Automation Auth Bypass Vulnerability

CVE-2026-9636 Overview

CVE-2026-9636 affects Rockwell Automation CompactLogix 5380, ControlLogix 5580, and EN4 communication modules. The controllers fail to reject certificates signed by an intermediate Certificate Authority (CA) that has been revoked through a Certificate Revocation List (CRL). A network-based attacker can leverage a certificate that should be considered untrusted to establish a Common Industrial Protocol (CIP) Security session. This weakness undermines the trust model that CIP Security relies on to authenticate peers in industrial control environments. The flaw is categorized under CWE-299: Improper Check for Certificate Revocation.

Critical Impact
An attacker on the network can bypass CIP Security peer authentication by presenting a certificate chained to a revoked intermediate CA, gaining trusted communications with industrial controllers.

Affected Products

Rockwell Automation CompactLogix 5380 controllers
Rockwell Automation ControlLogix 5580 controllers
Rockwell Automation EN4 communication modules

Discovery Timeline

2026-07-14 - CVE-2026-9636 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-9636

Vulnerability Analysis

CIP Security is the security extension for the Common Industrial Protocol used by Logix controllers to authenticate and encrypt communication with engineering workstations, HMIs, and peer devices. The specification requires endpoints to validate the full certificate chain, including revocation status of each intermediate CA. The affected Rockwell Automation controllers accept certificates signed by an intermediate CA even after that intermediate has been listed in a valid CRL. As a result, revocation events do not sever trust for previously issued end-entity certificates within that intermediate's scope. An attacker holding such a certificate can complete the CIP Security handshake and interact with the controller as an authorized peer.

Root Cause

The defect lies in the certificate chain validation logic on the controller. The implementation checks signature integrity and validity dates but does not enforce revocation status for intermediate CAs against the configured CRL. This omission maps to CWE-299: Improper Check for Certificate Revocation. The result is that revocation actions taken by an operator or PKI administrator have no protective effect against certificates chained under the revoked intermediate.

Attack Vector

Exploitation requires network access to the controller's CIP Security service and possession of a certificate signed by an intermediate CA that the controller previously trusted and that has since been revoked. The attacker initiates a CIP Security session and presents the certificate chain. The controller performs partial chain validation, ignores the CRL entry for the intermediate, and accepts the peer. From there the attacker can send CIP messages that would otherwise be blocked by the CIP Security policy. No user interaction is required, and the attack complexity is elevated because the attacker must first obtain a valid certificate under the revoked intermediate.

No public proof-of-concept exploit is available at this time. Refer to the Rockwell Automation Security Advisory SD1788 for vendor technical details.

Detection Methods for CVE-2026-9636

Indicators of Compromise

CIP Security session establishment from unexpected source IP addresses or engineering workstations not enrolled in the CIP Security policy.
Successful controller connections presenting certificates chained to CA identifiers previously marked as revoked in the operator's PKI.
Configuration changes, program downloads, or mode changes on Logix controllers correlated with unfamiliar client certificates.

Detection Strategies

Correlate PKI CRL publication events with CIP Security session logs to flag any session accepting a certificate under a revoked intermediate.
Baseline the set of client certificates and source hosts that normally communicate with each CompactLogix 5380, ControlLogix 5580, and EN4 module, then alert on deviations.
Deploy passive OT network monitoring capable of parsing CIP and EtherNet/IP traffic to extract TLS certificate metadata for validation against the current CRL.

Monitoring Recommendations

Forward controller audit logs and CIP Security session events into a centralized SIEM or data lake for cross-source correlation with PKI activity.
Continuously monitor Purdue Level 1 and Level 2 network segments for new or unauthorized CIP Security peers.
Track certificate serial numbers and issuer identifiers observed on the OT network and alert when a session uses a chain that intersects a revoked intermediate.

How to Mitigate CVE-2026-9636

Immediate Actions Required

Review the Rockwell Automation Security Advisory SD1788 and apply the firmware updates listed for CompactLogix 5380, ControlLogix 5580, and EN4 modules.
Restrict network access to CIP Security endpoints using firewall rules that permit only known engineering workstations and HMIs.
Rotate and reissue end-entity certificates whose issuing intermediate CA has been revoked, then remove the revoked intermediate from all trust stores.

Patch Information

Rockwell Automation has published remediation guidance in advisory SD1788. Refer to the Rockwell Automation Security Advisory for the specific fixed firmware versions for CompactLogix 5380, ControlLogix 5580, and EN4 communication modules, and schedule maintenance windows to deploy the updates.

Workarounds

Segment Logix controllers behind an industrial DMZ or firewall that terminates and re-validates TLS, enforcing CRL checks at the perimeter.
Reduce the operational lifetime of issued end-entity certificates to minimize the exposure window when an intermediate is revoked.
Where feasible, replace revoked intermediates by rebuilding the affected PKI hierarchy so that no end-entity certificate remains chained to the revoked CA.

bash

# Example: filter CIP Security traffic (TCP 2221 and EtherNet/IP 44818) to authorized hosts only
iptables -A FORWARD -p tcp --dport 2221 -s 10.10.20.0/24 -d 10.20.30.10 -j ACCEPT
iptables -A FORWARD -p tcp --dport 2221 -d 10.20.30.10 -j DROP
iptables -A FORWARD -p tcp --dport 44818 -s 10.10.20.0/24 -d 10.20.30.10 -j ACCEPT
iptables -A FORWARD -p tcp --dport 44818 -d 10.20.30.10 -j DROP