Exploitation timeline
Threadlinqs has recorded 6 Rockwell Automation CVEs published between and . The busiest month was 2026-10 (2 new CVEs). 1 of them (17%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked Rockwell Automation CVEs.
- CVE-2021-22681critical 9.8KEVEPSS 63.6%
- CVE-2024-6242high 7.3EPSS 11.1%
- CVE-2017-16740critical 10EPSS 7.2%
- CVE-2023-3595critical 9.8EPSS 5.5%
- CVE-2026-12655high 8.8EPSS 0.3%
- CVE-2026-12656high 8.7EPSS 0.3%
Products affected
Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 52 distinct Rockwell Automation products are affected. The most frequently affected (top 20):
- 1732E ArmorBlock® I/O 2 CVEs
- 1756-EN2F 1 CVE
- 1756-EN2T 1 CVE
- 1756-EN2T Series A, B, C 1 CVE
- 1756-EN2T Series D 1 CVE
- 1756-EN2TK Series A, B, C 1 CVE
- 1756-EN2TP 1 CVE
- 1756-EN2TP Series A 1 CVE
- 1756-EN2TPK Series A 1 CVE
- 1756-EN2TR 1 CVE
- 1756-EN2TR Series A, B 1 CVE
- 1756-EN2TR Series C 1 CVE
- 1756-EN2TRK Series A, B 1 CVE
- 1756-EN2TRK Series C 1 CVE
- 1756-EN2TXT Series A, B, C 1 CVE
- 1756-EN2TXT Series D 1 CVE
- 1756-EN3TR 1 CVE
- 1756-EN4TR 1 CVE
- 1766-l32awa 1 CVE
- 1766-l32awa Firmware 1 CVE
Threat activity
14 tracked threat campaigns reference Rockwell Automation products or exploit Rockwell Automation CVEs:
- Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198HIGH
- Threat actors targeting internet-exposed PLCs in US water/wastewater sector causing lockouts, disconnections and boil water notices (CISA alert 2026-07-30; Iranian-affiliated PLC campaign AA26-097A)HIGH
- Energy & Utilities Cyber Exposure: Ransomware Loss Concentration (Resilience Report) and July 2026 Internet-Exposed PLC Attacks on US Water Utilities (Rockwell MicroLogix)HIGH
- ICS Patch Tuesday (Oct 2026): Rockwell 1732E ArmorBlock unauthenticated admin takeover (CVE-2026-12655), ABB dynovaPRO / Siemens Industrial Edge Management credential reset bypass (CVE-2026-18963)CRITICAL
- Centrii: Nation-State Pre-Positioning (Volt Typhoon, IRGC-Affiliated PLC Exploitation) and Renewable Supply-Chain Risk Raise Energy Sector ExposureHIGH
- OT Attacks on US Critical Infrastructure: Volt Typhoon Persistence and Iranian-Affiliated PLC Exploitation (Rockwell, Unitronics, Siemens S7)CRITICAL
- AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical InfrastructureCRITICAL
- Rapid7 Q2 2026 Threat Landscape Report: Vulnerability Disclosures Double, AI-Assisted Exploitation Compresses Patch TimelinesHIGH
- Sage Water Resources Utah saltwater disposal facility PLC intrusion — Iranian IRGC-CEC (CyberAv3ngers) logic manipulation bypasses pump safeguardsHIGH
- Iran-Linked CyberAv3ngers (BAUXITE) Exploiting Internet-Exposed Rockwell, Schneider Electric, and Siemens PLCs Across US Water, Energy, and Government Infrastructure (CISA AA26-097A)CRITICAL
- ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT 'BH Alert' Android Spyware Targeting BahrainHIGH
- NCSC CEO Richard Horne: Hostile States Linked to Three-Quarters of Cyber Attacks on UK Critical National InfrastructureMEDIUM
- Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A)CRITICAL
- CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) & Rockwell Logix Credential Exposure (CVE-2021-22681) — Active ExploitationCRITICAL
Threat actors targeting Rockwell Automation
Named threat actors attributed to campaigns that involve Rockwell Automation products or CVEs, with the number of linked campaigns:
How to prioritise Rockwell Automation patching
This order follows the data Threadlinqs holds for Rockwell Automation, not a generic severity checklist:
- 1 of 6 Rockwell Automation CVEs (17%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2021-22681.
- Outside KEV, the highest EPSS scores are CVE-2024-6242 (11.1%), CVE-2017-16740 (7.2%), CVE-2023-3595 (5.5%).
- 3 CVEs score Critical and 3 High on CVSS v3 (maximum 10, average 9.1); sequence these after KEV and high-EPSS items.
- 2 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-05 and refresh daily.