High severity · published Jul 14, 2026
CVE-2026-9653
1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID
8.7
CVSS
0.2%
EPSS
No
On KEV
Description
A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
11
1756-EN2, 1756-EN3 · Rockwell Automation
12.001 and before · source: vendor
17
1756-ENBT · Rockwell Automation
6.006 · source: vendor
In the news
VulnerabilityHigh
Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT
View CSAF
Summary
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
The following versions of Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT are affected:
1756-EN3 <=V12.001 (CVE-2026-9653)
1756-EN2 <=V12.001 (CVE-2026-9653)
1756-ENBT V6.006 (CVE-2026-9653)
CVSS
Vendor
Equipment
Vulnerabilities
v3 7.5
Rockwell Automation
Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT
Improper Validation of Integrity Check Value
Background
Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: United States
Vulnerabilities
Expand All +
CVE-2026-9653
A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.
View CVE Details
Affected Products
Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT
Vendor: Rockwell Automation
Product Version: Rockwell Automation 1756-EN3: <=V12.001, Rockwell Automation 1756-EN2: <=V12.001, Rockwell Automation 1756-ENBT: V6.006
Product Status: known_affected
Remediations
Vendor fix Rockwell Automation recommend...
Jul 16, 2026·CISA Advisories