# Rockwell Automation vulnerabilities & exploitation

**CISA KEV**

> As of 2026-11-06, Threadlinqs tracks 6 Rockwell Automation CVEs, 1 in the CISA Known Exploited Vulnerabilities catalog, linked to 15 tracked threat campaigns and 5 named threat actors.

**Data as of:** 2026-11-06

## Exploitation timeline

Threadlinqs has recorded 6 Rockwell Automation CVEs published between 2018-01-15 and 2026-10-15. The busiest month was 2026-10 (2 new CVEs). 1 of them (17%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked Rockwell Automation CVEs.

- [CVE-2021-22681](https://intel.threadlinqs.com/cve/CVE-2021-22681) — CRITICAL 9.8 · KEV · EPSS 63.6% · 2021-03-03
- [CVE-2024-6242](https://intel.threadlinqs.com/cve/CVE-2024-6242) — HIGH 7.3 · EPSS 11.1% · 2024-08-01
- [CVE-2017-16740](https://intel.threadlinqs.com/cve/CVE-2017-16740) — CRITICAL 10 · EPSS 7.2% · 2018-01-09
- [CVE-2023-3595](https://intel.threadlinqs.com/cve/CVE-2023-3595) — CRITICAL 9.8 · EPSS 5.5% · 2023-07-12
- [CVE-2026-12655](https://intel.threadlinqs.com/cve/CVE-2026-12655) — HIGH 8.8 · EPSS 0.3% · 2026-10-13
- [CVE-2026-12656](https://intel.threadlinqs.com/cve/CVE-2026-12656) — HIGH 8.7 · EPSS 0.3% · 2026-10-13

## Products affected

Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 52 distinct Rockwell Automation products are affected. The most frequently affected (top 20):

- 1732E ArmorBlock® I/O — 2 CVEs
- 1756-EN2F — 1 CVE
- 1756-EN2T — 1 CVE
- 1756-EN2T Series A, B, C — 1 CVE
- 1756-EN2T Series D — 1 CVE
- 1756-EN2TK Series A, B, C — 1 CVE
- 1756-EN2TP — 1 CVE
- 1756-EN2TP Series A — 1 CVE
- 1756-EN2TPK Series A — 1 CVE
- 1756-EN2TR — 1 CVE
- 1756-EN2TR Series A, B — 1 CVE
- 1756-EN2TR Series C — 1 CVE
- 1756-EN2TRK Series A, B — 1 CVE
- 1756-EN2TRK Series C — 1 CVE
- 1756-EN2TXT Series A, B, C — 1 CVE
- 1756-EN2TXT Series D — 1 CVE
- 1756-EN3TR — 1 CVE
- 1756-EN4TR — 1 CVE
- 1766-l32awa — 1 CVE
- 1766-l32awa Firmware — 1 CVE

## Threat activity

15 tracked threat campaigns reference Rockwell Automation products or exploit Rockwell Automation CVEs:

- [Scans for Cisco IOS XE Web UI Vulnerability (CVE-2023-20198) with RootEvidence Opt-Out Headers](https://intel.threadlinqs.com/threat/TL-2026-5345) — MEDIUM — 2026-11-05
- [Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198](https://intel.threadlinqs.com/threat/TL-2026-4980) — HIGH — 2026-11-01
- [Threat actors targeting internet-exposed PLCs in US water/wastewater sector causing lockouts, disconnections and boil water notices (CISA alert 2026-07-30; Iranian-affiliated PLC campaign AA26-097A)](https://intel.threadlinqs.com/threat/TL-2026-4538) — HIGH — 2026-10-27
- [Energy & Utilities Cyber Exposure: Ransomware Loss Concentration (Resilience Report) and July 2026 Internet-Exposed PLC Attacks on US Water Utilities (Rockwell MicroLogix)](https://intel.threadlinqs.com/threat/TL-2026-4339) — HIGH — 2026-10-24
- [ICS Patch Tuesday (Oct 2026): Rockwell 1732E ArmorBlock unauthenticated admin takeover (CVE-2026-12655), ABB dynovaPRO / Siemens Industrial Edge Management credential reset bypass (CVE-2026-18963)](https://intel.threadlinqs.com/threat/TL-2026-3518) — CRITICAL — 2026-10-14
- [Centrii: Nation-State Pre-Positioning (Volt Typhoon, IRGC-Affiliated PLC Exploitation) and Renewable Supply-Chain Risk Raise Energy Sector Exposure](https://intel.threadlinqs.com/threat/TL-2026-3319) — HIGH — 2026-10-11
- [OT Attacks on US Critical Infrastructure: Volt Typhoon Persistence and Iranian-Affiliated PLC Exploitation (Rockwell, Unitronics, Siemens S7)](https://intel.threadlinqs.com/threat/TL-2026-2961) — CRITICAL — 2026-10-06
- [AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-2076) — CRITICAL — 2026-08-19
- [Rapid7 Q2 2026 Threat Landscape Report: Vulnerability Disclosures Double, AI-Assisted Exploitation Compresses Patch Timelines](https://intel.threadlinqs.com/threat/TL-2026-2058) — HIGH — 2026-08-18
- [Sage Water Resources Utah saltwater disposal facility PLC intrusion — Iranian IRGC-CEC (CyberAv3ngers) logic manipulation bypasses pump safeguards](https://intel.threadlinqs.com/threat/TL-2026-1882) — HIGH — 2026-08-04
- [Iran-Linked CyberAv3ngers (BAUXITE) Exploiting Internet-Exposed Rockwell, Schneider Electric, and Siemens PLCs Across US Water, Energy, and Government Infrastructure (CISA AA26-097A)](https://intel.threadlinqs.com/threat/TL-2026-1697) — CRITICAL — 2026-07-25
- [ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT 'BH Alert' Android Spyware Targeting Bahrain](https://intel.threadlinqs.com/threat/TL-2026-1659) — HIGH — 2026-07-23
- [NCSC CEO Richard Horne: Hostile States Linked to Three-Quarters of Cyber Attacks on UK Critical National Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-2239) — MEDIUM — 2026-06-17
- [Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A)](https://intel.threadlinqs.com/threat/TL-2026-0335) — CRITICAL — 2026-04-08
- [CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) & Rockwell Logix Credential Exposure (CVE-2021-22681) — Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-0181) — CRITICAL — 2026-03-06

## Threat actors targeting Rockwell Automation

Named threat actors attributed to campaigns that involve Rockwell Automation products or CVEs, with the number of linked campaigns:

- [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers) — 7 campaigns
- [Volt Typhoon - G1017](https://intel.threadlinqs.com/actor/Volt%20Typhoon%20-%20G1017) — 2 campaigns
- [APT28](https://intel.threadlinqs.com/actor/APT28) — 1 campaign
- [Qilin](https://intel.threadlinqs.com/actor/Qilin) — 1 campaign
- [Salt Typhoon - G1045](https://intel.threadlinqs.com/actor/Salt%20Typhoon%20-%20G1045) — 1 campaign

## How to prioritise Rockwell Automation patching

This order follows the data Threadlinqs holds for Rockwell Automation, not a generic severity checklist:

- 1 of 6 Rockwell Automation CVEs (17%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2021-22681](https://intel.threadlinqs.com/cve/CVE-2021-22681).
- Outside KEV, the highest EPSS scores are [CVE-2024-6242](https://intel.threadlinqs.com/cve/CVE-2024-6242) (11.1%), [CVE-2017-16740](https://intel.threadlinqs.com/cve/CVE-2017-16740) (7.2%), [CVE-2023-3595](https://intel.threadlinqs.com/cve/CVE-2023-3595) (5.5%).
- 3 CVEs score Critical and 3 High on CVSS v3 (maximum 10, average 9.1); sequence these after KEV and high-EPSS items.
- 2 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-06 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/rockwell-automation
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs for threats exploiting Rockwell Automation products unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp