CVE-2026-84235

CVE-2026-84235 is a high-severity (CVSS 4.0: 8.7) denial-of-service flaw in an affected Rockwell Automation module, assigned by the vendor's PSIRT. The bug, classified as CWE-400 (uncontrolled resource consumption), is triggered when an attacker sends a crafted CIP (Common Industrial Protocol) packet to the device over the network, with no privileges or user interaction required per the CVSS 4.0 vector. A successful attack crashes the module, with no confidentiality or integrity impact, but the module stops performing its automation function and requires a restart to recover. Organizations running Rockwell Automation industrial devices that process CIP traffic are potentially affected; the specific product line and version range were not detailed in the available data. The flaw is not known to be exploited: it is absent from CISA KEV, no public proof-of-concept is known, and EPSS places the 30-day exploitation probability at just 0.3% (24th percentile).

What to do: Watch for Rockwell Automation's advisory for CVE-2026-84235 and apply the vendor's firmware update when published, since the affected product/version range is not yet detailed in the available data. Until patched, restrict untrusted network access to the module's CIP/EtherNet-IP services and segment OT networks so unauthenticated peers cannot send CIP packets to the device. Because recovery requires a manual restart, add affected modules to monitoring and prepare restart procedures in case of a crash.