CIP Security authentication bypass hits Rockwell Logix, EN4TR

The vulnerability sits at CWE-299 (Improper Check for Certificate Revocation) and that's what makes it worth paying attention to. Most Rockwell ICS advisories over the past two years have been denial-of-service: a malformed packet, a crafted PTP management message, a Concurrent Forward Close operation, and the controller faults. CVE-2026-9636 is different. The controller accepts an authentication attempt backed by an intermediate certificate that a CRL says is dead. CIP Security is meant to enforce device-level authentication and data integrity on the plant floor. When the revocation check fails, that enforcement evaporates.

Rockwell assigned CVSS v3.1 a 5.9 (MEDIUM) and CVSS v4 an 8.2 (HIGH). The gap between the two scoring systems tells the story. Under v3.1, the attack complexity is "High" and the confidentiality impact is "High," but the scope is unchanged and there's no integrity or availability impact, hence the 5.9. Under v4, the same facts score 8.2 because v4 weights the downstream confidentiality exposure more heavily and doesn't kneecap the score for unchanged scope. If you're running these controllers in a defense-industrial environment where CIP Security is the authentication boundary between zones, treat it as the v4 score.

Firmware updates push the Logix family to V38.011 and EN4TR modules to V8.001. The advisory doesn't say whether the bypass enables lateral movement to downstream systems once CIP Security authentication is defeated, or whether the attacker is contained to the compromised module. That's the operational question for Monday morning: if you can't patch immediately, segment the affected controllers behind an additional network authentication layer until you can.

This is Rockwell's third ICS advisory in ten days, following last week's I/O module DoS disclosures, but it's the first one where the threat model is authentication bypass rather than availability loss.