Is CVE-2026-0647 actively exploited?

No active exploitation of CVE-2026-0647 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-0647 be exploited remotely?

Yes. CVE-2026-0647 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-0647?

CVE-2026-0647 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2026-0647

HIGH

CVE-2026-0647

CWE-306Published: June 16, 2026· Updated: Jun 17, 2026

8.8

CVSS v3.1

EPSS:0.43%probability of exploitation in 30 daysPercentile:34.6th

Official Description

An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server. The vulnerability allows an unauthenticated attacker to change the device's web interface password by sending a crafted HTTP GET request to a specific endpoint, without any prior authentication being required. If exploited, this could lead to unauthorized access, account takeover, and loss of the device’s embedded web server’s availability.

NVD Source

Technical Analysis

CVE-2026-0647 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2026-0647

Rockwell Automation FLEX I/O EtherNet/IP Adapters

CISA Alerts· Jun 16, 2026

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access, account takeover, and cause loss of availability. The following versions of Rockwell Automation FLEX I/O EtherNet/IP Adapters are affected: 1794-AENTR V2.012 (CVE-2026-0646, CVE-2026-0647) 1794-AENTRXT V2.012 (CVE-2026-0646, CVE-2026-0647) CVSS Vendor Equipment Vulnerabilities v3 9.4 Rockwell Automation Rockwell Automation FLEX I/O EtherNet/IP Adapters Missing Release of Memory after Effective Lifetime, Missing Authentication for Critical Function Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-06 [xlite_meta score:85 src:CISA Alerts xlite_fp:ac7908de441ddb2a79d684b5944162b2e05f1d0f7ecff69cb55d8674e9890861]