Is CVE-2026-9636 actively exploited?

No active exploitation of CVE-2026-9636 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-9636 be exploited remotely?

Yes. CVE-2026-9636 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-9636?

CVE-2026-9636 has a CVSS score of 8.2 (HIGH).

HOME VULNERABILITIESCVE-2026-9636

HIGH

CVE-2026-9636

CWE-299Published: July 14, 2026· Updated: Jul 14, 2026

8.2

CVSS v3.1

Official Description

A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections.

NVD Source

Technical Analysis

CVE-2026-9636 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X