CVE-2026-9636: Rockwell Automation Logix Controllers CRL Bypass (pending)

CVE-2026-9636 is a certificate-revocation check failure in Rockwell Automation CompactLogix 5380, ControlLogix 5580, GuardLogix 5580, Compact GuardLogix 5380 controllers and the 1756-EN4TR module: they accept certificates signed by an intermediate CA certificate that has already been revoked via CRL, letting a network attacker bypass CIP Security. It is not on CISA's KEV list and NVD's own record still shows "Awaiting Analysis" as of 2026-10-28, so this page is pending and the 8.2/5.9 figures below are Rockwell's own CNA submission, not an NVD-confirmed score.

CVE-2026-9636 is an improper certificate-revocation check (CWE-299) affecting Rockwell Automation's Logix 5580/5380 controller family and the 1756-EN4TR communications module. Per the CISA ICS advisory, affected devices fail to reject "certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL)", which lets an attacker who possesses such a revoked certificate bypass the device's CIP Security authentication protections (CISA ICS Advisory ICSA-26-211-05).

NVD lists two scores submitted by the Rockwell Automation CNA ([email protected]): CVSS v3.1 5.9 (MEDIUM), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, and CVSS v4.0 8.2 (HIGH), vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N (NVD). NVD's vulnerability-status field for CVE-2026-9636 still reads "Awaiting Analysis" as of 2026-10-28 — NVD has not published its own independent score — and the CVE does not appear on the CISA Known Exploited Vulnerabilities catalog. Per our indexing policy, this page therefore stays noindex and shows no NVD-confirmed cvss_score until NVD completes analysis or CISA adds the CVE to KEV; the 5.9/8.2 figures above are Rockwell's own submission, not NVD's.

Rockwell Automation's own advisory page (SD1788 on the Trust Center) returned an HTTP 403 when fetched for this page, so the version and remediation detail here is drawn from the CISA ICS advisory (a standard republication of vendor advisories) and from NVD rather than the vendor page directly. Affected versions are ControlLogix 5580, CompactLogix 5380, GuardLogix 5580 and Compact GuardLogix 5380 firmware V36 through V37 (fixed in V38.011) and the 1756-EN4TR module firmware V6.001/V7.001 (fixed in V8.001); CISA's recommended mitigations are to update to the fixed firmware and, until then, minimize control-system network exposure and require VPNs for any remote access (CISA ICS Advisory ICSA-26-211-05).

Neither CISA nor NVD report observed in-the-wild exploitation of CVE-2026-9636. As of 2026-10-28, FIRST scores the probability of exploitation at 0.00216 (12.1th percentile), consistent with an authenticated/network-adjacent flaw with no known active exploitation (FIRST EPSS).

Until NVD completes its analysis, treat the 8.2 CVSS v4.0 figure as indicative only; sites running the affected Logix controllers or the 1756-EN4TR module should still plan the firmware update, since the underlying issue — accepting a certificate CIP Security should have rejected — undermines the certificate-based trust model these devices rely on.

• Affected Logix controllers and the 1756-EN4TR module fail to reject certificates signed by a revoked intermediate CA certificate, letting an attacker bypass CIP Security. — CISA ICS Advisory ICSA-26-211-05
• CVSS v3.1 5.9 (MEDIUM) and CVSS v4.0 8.2 (HIGH), both submitted by the Rockwell Automation CNA ([email protected]); NVD vulnStatus is Awaiting Analysis as of 2026-10-28. — NVD
• Affected: ControlLogix 5580/CompactLogix 5380/GuardLogix 5580/Compact GuardLogix 5380 V36-V37 (fixed V38.011); 1756-EN4TR V6.001/V7.001 (fixed V8.001). No known public exploitation reported. — CISA ICS Advisory ICSA-26-211-05
• EPSS score is 0.00216 (12.095th percentile) as of 2026-10-28. — FIRST EPSS