CVE-2026-9653

1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID

State: Published
Severity: 8.7 High
Published: Jul 14, 2026
Updated: Jul 14, 2026
Reserved: May 26, 2026

Description

A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	Rockwell

Weaknesses

CWE-354 Improper validation of integrity check value

Affected Products

Product	Versions
1756-EN2, 1756-EN3Rockwell Automation	12.001 and beforeAffected
1756-ENBTRockwell Automation	6.006Affected

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1780.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.