Rockwell Automation ControlLogix, CompactLogix, GuardLogix, and 1756-EN4TR Improper Check for Certificate Revocation (CVE-2026-9636)

high Tenable OT Security Plugin ID 505889

Synopsis

The remote OT asset is affected by a vulnerability.

Description

The affected products fail to properly reject certificates signed by an intermediate certificate authority that has been revoked via a Certificate Revocation List (CRL). A network-based attacker who holds such a certificate can leverage it to establish a Common Industrial Protocol (CIP) Security session that should be untrusted, potentially bypassing CIP Security protections. This issue only affects users who have the CRL feature enabled and are using intermediate certificates.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Rockwell Automation recommends users update to the following corrected versions:

- ControlLogix 5580: Update to V38.011 or later.
- CompactLogix 5380: Update to V38.011 or later.
- GuardLogix 5580: Update to V38.011 or later.
- Compact GuardLogix 5380: Update to V38.011 or later.
- 1756-EN4TR: Update to V7.001 or later.

Rockwell Automation also recommends users follow their published Security Best Practices.

Plugin Details

Severity: High

ID: 505889

File Name: tenable_ot_rockwell_CVE-2026-9636.nasl

Version: 1.2

Type: Remote

Family: Tenable.ot

Published: 7/29/2026

Updated: 7/30/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.12

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.2

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:rockwellautomation:1756-en4tr_firmware, cpe:/o:rockwellautomation:compact_guardlogix_5380_firmware, cpe:/o:rockwellautomation:compactlogix_5380_firmware, cpe:/o:rockwellautomation:controllogix_5580_firmware, cpe:/o:rockwellautomation:guardlogix_5580_firmware

Required KB Items: Tenable.ot/Rockwell

Exploit Ease: No known exploits are available

Patch Publication Date: 7/14/2026

Vulnerability Publication Date: 7/14/2026

Reference Information

CVE: CVE-2026-9636

CWE: 299

Detections

Analytics