CVE-2026-9622

CVE-2026-9622 is a remotely exploitable denial-of-service flaw in Rockwell Automation RSLinx Classic, an industrial communications and OPC server product used alongside Allen-Bradley controllers. An attacker with network reachability to the service can send a crafted CIP (Common Industrial Protocol) packet targeting the Forward Close service, which the software mishandles due to an integer coercion error (CWE-191). The result is a crash of the RSLinx Classic service, and a manual restart of the service is required to restore operations; there is no confidentiality or integrity impact and no indication of code execution. The CVSS 4.0 score of 8.7 (High) reflects unauthenticated network access with a high availability impact on the vulnerable system. No public proof-of-concept exists, the issue is not in CISA KEV, and EPSS estimates the 30-day exploitation probability at about 0.3 percent, so no exploitation is currently known.

What to do: Monitor Rockwell Automation's security advisory for CVE-2026-9622 and upgrade RSLinx Classic to a patched release once one is published, since no fixed version is given in the available data. In the meantime, restrict network access to the CIP/EtherNet-IP service used by RSLinx (commonly TCP/44818 and related EtherNet/IP traffic) from untrusted networks and keep it segmented from corporate or internet-facing zones. Ensure staff know the recovery procedure (restart the RSLinx Classic service) and monitor for unexpected service crashes as an indicator of probing or exploitation.