A malformed packet can knock Rockwell's Flex 5000 Adapter offline until someone power-cycles it
Rockwell Automation has patched a denial-of-service flaw in a widely deployed factory-floor module. The fix ships as firmware 6.012.
Key points
- Rockwell Automation disclosed CVE-2026-12659 on 16 July 2026, a denial-of-service flaw in its Flex 5000 Adapter running firmware 6.011.
- The bug scores 7.5 on the CVSS 3.1 scale and 8.7 on the newer CVSS 4.0 scale, both rated high severity.
- A single crafted network packet can freeze the module and its attached inputs and outputs until an engineer physically power-cycles the hardware.
- Rockwell has released firmware 6.012 as the fix and asks customers who can't patch to isolate the device from the wider network.
- CISA says no one has been seen exploiting this in the wild.
Rockwell Automation has patched a flaw in its Flex 5000 Adapter, a small industrial computer that sits on production lines and shuttles signals between sensors and motors, relaying them to the main controller. We covered Rockwell's broader July patch round the day before this advisory dropped.
The bug is tracked as CVE-2026-12659. It affects firmware version 6.011. The fix is version 6.012.
The plain-English version: an attacker on the same network sends the adapter a specially malformed message, the device trips over its own error handling and locks up. Everything wired to it stops responding. The only recovery is a physical power cycle.
That's a denial-of-service flaw, meaning a bug that stops a system doing its job without necessarily letting the attacker steal anything.
How bad is this in practice?
Bad enough to take seriously, not bad enough to panic. The attacker can't read data or plant malware through this bug alone. But on a factory floor, an adapter falling over can mean a stopped line or an emergency call-out at 3am.
The underlying weakness is a double free, where software accidentally releases the same chunk of memory twice and corrupts its own state. It's triggered by a crafted CIP packet. CIP, or Common Industrial Protocol, is the language Rockwell devices use to talk to each other over the network. If that sounds familiar, it should: this is the industrial-controls equivalent of a classic malformed-packet crash in an old web server. Same shape of bug, different neighbourhood.
CVSS, the Common Vulnerability Scoring System, is the industry's standard for rating flaw severity. Rockwell and CISA give this one a 7.5 under the older scoring and 8.7 under the newer version. The jump reflects the newer system's heavier weighting of availability, keeping a system running. For a device that lives on a factory floor, that reweighting is fair.
What should operators do now?
Upgrade to Flex 5000 Adapter firmware 6.012. That's the clean answer, and it comes straight from Rockwell's advisory SD1789.
Where an immediate upgrade isn't possible, and in industrial settings it very often isn't, the standard playbook applies. Keep the adapter off the public internet. Put it behind a firewall and segment the plant network from the office network.
CISA published the advisory on 16 July 2026 after Rockwell reported the flaw itself. The agency has seen no attacks using this bug so far.
Rockwell found and disclosed the issue in-house, which deserves a small nod. Vendors sitting on flaws until a researcher forces the issue is still common in the industrial-controls world, as our story on decades-old ICS software laid out last month. This wasn't one of those cases.
