CVE-2026-9140 Rockwell Automation CVE debrief

Who should care

Industrial control system administrators and security teams responsible for Rockwell Automation 1718-AENTR/1719-AENTR devices should review and apply recommended security updates to prevent potential denial-of-service attacks.

Technical summary

The Rockwell Automation 1719-AENTR is vulnerable to a denial-of-service security issue due to improper handling of UDP unicast network storms. This causes the device to become overloaded and lose communication, requiring a power cycle to recover. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. Industrial control system administrators and security teams should review and apply recommended security updates to prevent potential denial-of-service attacks. The issue is caused by improper handling of a UDP unicast network storm.

Defensive priority

Immediately review and apply vendor-recommended security updates to prevent potential denial-of-service attacks.

Recommended defensive actions

• Apply Rockwell Automation's recommended security updates to version 3.012 or later.
• Implement Rockwell Automation's security best practices.
• Monitor for unusual network activity and system behavior.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the denial-of-service security issue in Rockwell Automation 1718-AENTR/1719-AENTR. Evidence is based on official CVE and source item records. The issue is caused by improper handling of a UDP unicast network storm, which causes the device to become overloaded and lose communication. A power cycle is required to recover. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.