High severity · published Jul 14, 2026
CVE-2026-12659
Rockwell Automation Flex 5000® Adapter - Denial of Service
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
The FLEX 5000® EtherNet/IP Adapter · Rockwell Automation
version 6.011 · source: vendor
In the news
VulnerabilityHigh
Rockwell Automation Flex 5000 Adapter
View CSAF
Summary
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition on the affected product.
The following versions of Rockwell Automation Flex 5000 Adapter are affected:
Flex 5000 Adapter 6.011 (CVE-2026-12659)
CVSS
Vendor
Equipment
Vulnerabilities
v3 7.5
Rockwell Automation
Rockwell Automation Flex 5000 Adapter
Double Free
Background
Critical Infrastructure Sectors: Critical Manufacturing, Information Technology
Countries/Areas Deployed: Worldwide
Company Headquarters Location: United States
Vulnerabilities
Expand All +
CVE-2026-12659
A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.
View CVE Details
Affected Products
Rockwell Automation Flex 5000 Adapter
Vendor: Rockwell Automation
Product Version: Rockwell Automation Flex 5000 Adapter: 6.011
Product Status: known_affected
Remediations
Vendor fix Rockwell Automation recommends users to upgrade to the following: Flex 5000 Adapter version 6.012.
Mitigation Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://supp...
Jul 16, 2026·CISA Advisories
Affected product
TF
The FLEX 5000® EtherNet/IP Adapter
Rockwell Automation
