High severity · published Sep 3, 2026
CVE-2026-6071
Code Execution Vulnerability in Arena®
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a malicious page or open a malicious file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Arena · Rockwell Automation
All versions 16.20.08 and prior · source: vendor
In the news
VulnerabilityHigh
ZDI-26-438: Rockwell Automation Arena Simulation DOE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Arena Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-6071.
Jul 15, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6071
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6071
www.rockwellautomation.com
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1713.html
More from Arena
7.8
CVE-2024-12175
Rockwell Automation Code Execution Vulnerability in Arena
7.3
CVE-2024-11364
Rockwell Automation Third Party Vulnerability in Arena®
7.3
CVE-2024-12672
Rockwell Automation Third Party Vulnerability in Arena®
7.3
CVE-2024-11157
Rockwell Automation Third Party Vulnerability in Arena