Rockwellautomation vulnerabilities9 known to be exploited.
Rockwellautomation has 312 published vulnerabilities across 487 products in our catalogue. 9 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Arena, with 28. If you run Rockwellautomation software, patch the exploited flaws first.
The most recent Rockwellautomation flaw added to the known-exploited list is CVE-2021-22681, on 5 March 2026. We keep watching the known-exploited list.
Which Rockwellautomation products have the most vulnerabilities?
Arena leads with 28 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Rockwellautomation vulnerabilities are being exploited?
9 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
Multiple Rockwell products contain an insufficient protected credentials vulnerability.
- 10.0Cisco IOS XE Web UI Privilege Escalation Vulnerability
Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access.
- 8.8Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability
There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent...
- 8.6Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker...
- 8.6Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
- 8.6Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
- 8.6Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected...
- 8.6Cisco IOS and IOS XE Software Improper Input Validation Vulnerability
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Which Rockwellautomation flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 82%CVE-2023-2915Critical
The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software...
- 77%CVE-2023-27856High
In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer.
- 72%CVE-2023-2917Critical
The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability.
- 66%CVE-2019-6553Critical
A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior.
- 64%
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769,...
- 57%CVE-2012-6441Medium
An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP.
- 53%CVE-2020-12028High
In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate...
- 53%CVE-2020-12027Medium
All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system.
- 47%CVE-2010-2965Critical
The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3.6.1 and other products, allows remote attackers to read...
All Rockwellautomation products we track.
190 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Arenaarena28 vulnerabilities33 versions
- Micrologix 1400 B Firmwaremicrologix_1400_b_firmware22 vulnerabilities20 versions
- Factorytalk Viewfactorytalk_view17 vulnerabilities6 versions
- Factorytalk Linxfactorytalk_linx14 vulnerabilities9 versions
- Micrologix 1100 Firmwaremicrologix_1100_firmware14 vulnerabilities1 version
- Factorytalk Services Platformfactorytalk_services_platform13 vulnerabilities11 versions
- Thinmanagerthinmanager13 vulnerabilities103 versions
- Controllogix 5580 Firmwarecontrollogix_5580_firmware12 vulnerabilities18 versions
- Guardlogix 5580 Firmwareguardlogix_5580_firmware12 vulnerabilities15 versions
- Compactlogix 5380 Firmwarecompactlogix_5380_firmware11 vulnerabilities23 versions
- Micrologix 1400 Firmwaremicrologix_1400_firmware11 vulnerabilities3 versions
- Compactlogix 5480 Firmwarecompactlogix_5480_firmware10 vulnerabilities16 versions
- Factorytalk Assetcentrefactorytalk_assetcentre9 vulnerabilities12 versions
- Kepserver Enterprisekepserver_enterprise9 vulnerabilities3 versions
- Rslinxrslinx9 vulnerabilities28 versions
- 1763-L16awa Series a1763-l16awa_series_a8 vulnerabilities3 versions
- 1763-L16awa Series B1763-l16awa_series_b8 vulnerabilities3 versions
- 1763-L16bbb Series a1763-l16bbb_series_a8 vulnerabilities3 versions
- 1763-L16bbb Series B1763-l16bbb_series_b8 vulnerabilities3 versions
- 1763-L16bwa Series a1763-l16bwa_series_a8 vulnerabilities3 versions
- 1763-L16bwa Series B1763-l16bwa_series_b8 vulnerabilities3 versions
- 1763-L16dwd Series a1763-l16dwd_series_a8 vulnerabilities3 versions
- 1763-L16dwd Series B1763-l16dwd_series_b8 vulnerabilities3 versions
- Ab Micrologix Controllerab_micrologix_controller8 vulnerabilities4 versions
This directory lists the 190 Rockwellautomation products with at least one tracked version, of 487 in our catalogue.
Running Rockwellautomation? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
- Matched to
- Guardlogix on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 312 published vulnerabilities across 487 products and 899 versions from Rockwellautomation. The most recent Rockwellautomation flaw added to the known-exploited list is CVE-2021-22681, on 5 March 2026.
9 Rockwellautomation vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2021-22681, CVE-2023-20198 and CVE-2018-0167. The full list is on this page.
Arena, with 28 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Rockwellautomation products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.