CVE-2026-9653: 1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-07-14
Weakness: CWE-354

Description

A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.

Affected products

Rockwell Automation 1756-EN2, 1756-EN3: through 12.001
Rockwell Automation 1756-ENBT: 6.006

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1780.html

Get alerted when CVE-2026-9653 or the next vulnerability affects your stack