CVE-2026-9140 Rockwell Automation CVE debrief

Who should care

Industrial control system administrators and security teams responsible for Rockwell Automation 1718-AENTR/1719-AENTR devices should review and apply recommended security updates to prevent potential denial-of-service attacks.

Technical summary

The Rockwell Automation 1719-AENTR is vulnerable to a denial-of-service security issue due to improper handling of UDP unicast network storms. This causes the device to become overloaded and lose communication, requiring a power cycle to recover. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. Industrial control system administrators and security teams should review and apply recommended security updates to prevent potential denial-of-service attacks. The issue is caused by improper handling of a UDP unicast network storm.

Defensive priority

Immediately review and apply vendor-recommended security updates to prevent potential denial-of-service attacks.

Recommended defensive actions

• Apply Rockwell Automation's recommended security updates to version 3.012 or later.
• Implement Rockwell Automation's security best practices.
• Monitor for unusual network activity and system behavior.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the denial-of-service security issue in Rockwell Automation 1718-AENTR/1719-AENTR. Evidence is based on official CVE and source item records. The issue is caused by improper handling of a UDP unicast network storm, which causes the device to become overloaded and lose communication. A power cycle is required to recover. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources