Detections
Analytics

Rockwell Automation ControlLogix, CompactLogix, GuardLogix, and 1756-EN4TR Improper Check for Certificate Revocation (CVE-2026-9636)

medium Tenable OT Security Plugin ID 505889

Synopsis

The remote OT asset is affected by a vulnerability.

Description

The affected products fail to properly reject certificates signed by an intermediate certificate authority that has been revoked via a Certificate Revocation List (CRL). A network-based attacker who holds such a certificate can leverage it to establish a Common Industrial Protocol (CIP) Security session that should be untrusted, potentially bypassing CIP Security protections. This issue only affects users who have the CRL feature enabled and are using intermediate certificates.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Rockwell Automation recommends users update to the following corrected versions:

- ControlLogix 5580: Update to V38.011 or later.
- CompactLogix 5380: Update to V38.011 or later.
- GuardLogix 5580: Update to V38.011 or later.
- Compact GuardLogix 5380: Update to V38.011 or later.
- 1756-EN4TR: Update to V7.001 or later.

Rockwell Automation also recommends users follow their published Security Best Practices.

See Also

http://www.nessus.org/u?fa70d2b6

Plugin Details

Severity: Medium

ID: 505889

File Name: tenable_ot_rockwell_CVE-2026-9636.nasl

Version: 1.1

Type: Remote

Family: Tenable.ot

Published: 7/29/2026

Updated: 7/29/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.12

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v4

Risk Factor: Medium

Base Score: 4.8

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:rockwellautomation:1756-en4tr_firmware, cpe:/o:rockwellautomation:compact_guardlogix_5380_firmware, cpe:/o:rockwellautomation:compactlogix_5380_firmware, cpe:/o:rockwellautomation:controllogix_5580_firmware, cpe:/o:rockwellautomation:guardlogix_5580_firmware

Required KB Items: Tenable.ot/Rockwell

Patch Publication Date: 7/14/2026

Vulnerability Publication Date: 7/14/2026

Reference Information

CVE: CVE-2026-9636

CWE: 299