CVE-2026-8312: Rockwell Automation Arena® - Memory Corruption Vulnerability

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-10-24
Weakness: CWE-787

Description

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

Affected products

Rockwell Automation Arena®: before 17.00.01 — fixed in 17.00.01

How to fix

Upgrade to a fixed version: Rockwell Automation Arena® 17.00.01. Check the vendor advisory for mitigations.

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1784.html

Get alerted when CVE-2026-8312 or the next vulnerability affects your stack