Threat Intelligence / CVE / CVE-2021-22681

CVE-2021-22681 — Rockwellautomation Factorytalk Services Platform

CISA KEV

CVSS v3.1 9.8 (CRITICAL) · EPSS 15.3% (higher than 94.6% of all scored CVEs) · Priority 9/10 · Published 2021-03-03

As of 2026-03-06, CVE-2021-22681 is a CRITICAL-severity vulnerability in Rockwellautomation Factorytalk Services Platform, CVSS v3.1 9.8, EPSS 15.3% (94.6th percentile). It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-03-05), with a US federal remediation deadline of 2026-03-26. Threadlinqs Intelligence links 5 tracked threat campaigns to CVE-2021-22681, most recently “AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure”.

Last updated: 2026-03-06

What is CVE-2021-22681?

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

The record classifies CVE-2021-22681 under weakness class CWE-522. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 20 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 2020 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 9.8 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (FIRST): 15.3% probability of exploitation in the next 30 days, higher than 94.6% of all scored CVEs
CISA KEV: Listed since 2026-03-05, federal remediation deadline 2026-03-26
Threadlinqs priority: 9/10 — CISA KEV-listed, which Threadlinqs floors at 9
Published: 2021-03-03, last modified 2026-03-06

Is CVE-2021-22681 being exploited?

CISA added CVE-2021-22681 to the Known Exploited Vulnerabilities catalog on 2026-03-05, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-03-26 under BOD 22-01. It currently carries a trending score of 39 in the Threadlinqs vulnerability feed.

Affected products and versions

Rockwellautomation: Factorytalk Services Platform, Rslogix 5000, Studio 5000 Logix Designer, Compact Guardlogix 5370, Compact Guardlogix 5380, Compactlogix 1768, Compactlogix 1769, Compactlogix 5370, Compactlogix 5380, Compactlogix 5480, Controllogix 5550, Controllogix 5560, Controllogix 5570, Controllogix 5580, Drivelogix 1794-l34, Drivelogix 5560, Drivelogix 5730, Guardlogix 5570, Guardlogix 5580, Softlogix 5800

How to fix CVE-2021-22681

The record marks a vendor fix as available for CVE-2021-22681. Patch reference: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130709. Because CVE-2021-22681 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-03-26. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2021-22681

5 tracked threats in the Threadlinqs corpus reference CVE-2021-22681, either in the campaign’s CVE list or as an indicator on the campaign record.

AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure — CRITICAL · 2026-08-19
Iran-Linked CyberAv3ngers (BAUXITE) Exploiting Internet-Exposed Rockwell, Schneider Electric, and Siemens PLCs Across US Water, Energy, and Government Infrastructure (CISA AA26-097A) — CRITICAL · 2026-07-25
NCSC CEO Richard Horne: Hostile States Linked to Three-Quarters of Cyber Attacks on UK Critical National Infrastructure — MEDIUM · 2026-06-17
Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A) — CRITICAL · 2026-04-08
CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) & Rockwell Logix Credential Exposure (CVE-2021-22681) — Active Exploitation — CRITICAL · 2026-03-06

Sources

Seeded from nvd and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

Full detection coverage & IOCs for threats exploiting CVE-2021-22681 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence