When a specifically crafted CIP message is sent to an affected device, it triggers an improper memory buffer operation, resulting in a Major Nonrecoverable Fault (MNRF). This state forces the controller to stop its primary operations, requiring a physical power cycle to restore functionality. Given that these devices are widely deployed in the Critical Manufacturing sector, a successful exploitation could result in significant operational disruption. There is no evidence of active exploitation in the wild as of this advisory's release, but organizations should prioritize firmware updates to the recommended versions.

Impact

Successful exploitation of CVE-2026-9637 causes an immediate denial-of-service on the affected industrial controllers. Because the fault triggered is a Major Nonrecoverable Fault (MNRF), the controller enters a stop state and cannot be recovered remotely, necessitating manual technician intervention to perform a power cycle. This impacts process availability in manufacturing environments and requires downtime for remediation.

Recommendation

• Apply the firmware updates provided by Rockwell Automation to all affected controllers: update to V37.011, V34.015, V35.014, or V36.013 depending on your current version (CVE-2026-9637).
• Minimize network exposure by isolating industrial control system networks from enterprise networks and the internet.
• Implement defense-in-depth strategies to protect control system devices as outlined in CISA ICS-TIP-12-146-01B.
• If remote access to the OT environment is required, use secure VPNs that are patched and monitored for vulnerabilities.