Vulnerability · Published Sep 3, 2026 · Assigned by Rockwell
CVE-2026-6071Code Execution Vulnerability in Arena®
High 7.5
In plain English
A high-severity out-of-bounds write in Arena from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 4.0)7.5High
Exploit odds (30 days)0.5%top 56.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a malicious page or open a malicious file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | Arena | All versions 16.20.08 and prior |
Weakness: CWE-787 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N