Vulnerability · Published Jun 16, 2026 · Assigned by Rockwell
CVE-2026-9307Rockwell Automation CompactLogix 5370 Controllers – Multiple Vulnerabilities
Medium 6.3
In plain English
A medium-severity security flaw in CompactLogix 5370 from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's web server exposes CIP Connection IDs on the diagnostics webpage, which are accessible to any unauthenticated user on the network. This information can be leveraged by an attacker to construct malicious packets, leading to Denial-of-Service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | CompactLogix 5370 | V36 |
Weakness: CWE-497 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N