Rockwell Automation Vulnerabilities 2024–2026: Lookup by Product

The tables below collect the Rockwell Automation security advisories released from 1 January 2024 to date for the product lines most plants run: ControlLogix, CompactLogix, GuardLogix, 1756 modules, ThinManager, FactoryTalk View SE/ME, PanelView Plus 7, FactoryTalk Linx, Micro800, PowerFlex, Stratix and a few other FactoryTalk products. Each row gives the advisory ID, release date, affected products and versions, CVE, CVSS score, impact and what to do. The tables were read on 8 November 2026. Rockwell and CISA keep updating advisories: open the original advisory before you decide to update or touch a running system.

How to read the tables

• Advisory ID: ICSA-yy-ddd-nn is an advisory published by CISA; SDxxxx is an advisory on Rockwell's Trust Center. A row with only an SD number is one whose CISA page could not be opened on 8 November 2026, so the data comes from the Rockwell page.
• Date: the initial release date as the page states it; "updated" is the revision date in CISA's update history.
• CVSS: written with the version the page prints. CISA usually prints both v3 (or v3.1) and v4; Rockwell prints "CVSS 3.1" and "CVSS 4.0". The two versions give different numbers and are not directly comparable.
• MNRF (major nonrecoverable fault): the controller faults and stops running; depending on the advisory it restarts by itself (SD1661) or needs a restart, a power cycle, a program download or a reset to recover.
• Versions: many issues are fixed on several firmware branches (for example V34.014, V35.013, V36.011). Pick the fix on the branch you already run if the project is not ready for a new branch.

On exploitation: on the CISA pages in these tables, CISA states that no known public exploitation specifically targeting the vulnerability had been reported to it (at the time of publication); ICSA-24-284-19 (PowerFlex 6000T) carries no such statement, and none of these CISA pages reports active exploitation. Two Rockwell pages show a KEV status that differs between the page header and the detail table (SD1749, SD1792); in that case check CISA's KEV catalog. On 20 March 2026 Rockwell released SD1771, stating it had become aware of potential threat actor activity targeting Rockwell controllers and repeating its advice to disconnect devices from the internet.

For the three vulnerabilities analysed in depth (ICSA-21-056-03, ICSA-23-193-01, ICSA-24-214-09), see Rockwell PLC OT security hardening. Here ICSA-24-214-09 gets a single row.

Logix controllers and 1756 communication modules

ThinManager

FactoryTalk View SE

FactoryTalk View ME and PanelView Plus 7

FactoryTalk Linx

Other lines: summary by product family

To keep the tables short, the families below are summarised. See each advisory for the full CVE, CVSS and version data.

Applying this in a running plant

1. Know what the plant runs

1. List the equipment: catalog number, series and firmware of every controller and communication module.
2. For Logix controllers, read the firmware revision in "Controller Properties" in Studio 5000 Logix Designer while online, and record it.
3. Record the software versions on each PC: FactoryTalk View, FactoryTalk Linx, ThinManager, Activation Manager, AssetCentre.
4. Check each row against the "affected" list in the original advisory, not against this summary.
5. Watch for new advisories: Rockwell's Trust Center filters by product, CVSS severity and KEV status, with alert sign-up and RSS; CISA republishes Rockwell advisories under ICS Advisories.

2. Set priorities

Start with devices exposed to the internet or connected to the office network, then vulnerabilities that need no authentication and those that stop the controller. CISA reminds owners to perform impact analysis and risk assessment before deploying defensive measures.

3. Plan the update with the plant

1. Upload the program from every controller and keep an offline copy, as SD1771 recommends.
2. Check compatibility between firmware, Logix Designer and FactoryTalk software on compatibility.rockwellautomation.com (PCDC).
3. Test the new version on a spare controller or a test bench first.
4. Agree an outage window with production: a controller firmware update stops the machine. Some issues also need a program download or reset to recover.
5. After the update: check I/O connections, HMI and historian, then record the new versions.

When several steps come together (firmware, Logix Designer, FactoryTalk software), see the controller firmware upgrade and compatibility service.

4. Compensating measures when you cannot update yet

CISA's general recommendations in the advisories:

• Minimize network exposure for all control system devices, and make sure they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls, isolated from business networks.
• When remote access is required, use more secure methods such as VPNs, and keep the VPN updated to the latest version.

In SD1771 Rockwell adds, for ControlLogix and CompactLogix: put the controller mode switch in Run; deploy a CIP Security policy with FactoryTalk Policy Manager to require authenticated connections; close unauthenticated open ports on edge routers. For Micro850 and Micro870: also put the mode switch in Run.

Some advisories have their own workarounds, listed in the tables: block port 5353 when APD is not used, block UDP 319, 320 when PTP is not used, limit TCP 2031 for ThinManager, remove the INTERACTIVE group from the HMI project folder. For writing firewall rules see FactoryTalk and Logix firewall ports; for an overall network review see Industrial networks and OT security.