Rockwell Logix controller flaw CVE-2021-22681 used in attacks; no patch available
A flaw in Rockwell’s industrial controllers lets attackers with network access bypass checks and change controller settings or programs. CISA confirmed exploitation in March 2026. There is no patch: operators must apply Rockwell’s protective controls.
Nothing for you to do on household devices: these are industrial control systems. If your family owns or runs a business using them, ask its control-systems team to apply Rockwell advisory PN1550, remove direct internet access and implement the model-specific CIP Security or physical Run-switch protections.
What’s happening
CVE-2021-22681 affects Rockwell’s Logix industrial controllers and the software used to program them. An inadequately protected key can let an attacker who can reach a controller bypass verification and change its configuration or program. Disclosed in February 2021, the flaw was added to CISA’s exploited-vulnerability catalogue on 5 March 2026. Rockwell’s latest advisory remains dated 10 March and says no patch can address it. Protection depends on measures such as CIP Security, model-specific physical Run-switch settings and network isolation. Tenable later associated the flaw with Iranian-affiliated controller attacks, while acknowledging that CISA’s campaign advisory did not identify a specific exploited CVE. As at 3 November 2026, there is no vendor patch or reported resolution of the underlying flaw.
- What
- Flaw
- Affects
- Rockwell Automation Logix industrial controllers, RSLogix 5000 and Studio 5000 Logix Designer
- Affected
- RSLogix 5000 v16–20
Studio 5000 Logix Designer v21 and later, and corresponding Logix controllers running these versions
FactoryTalk Security within FactoryTalk Services Platform v2.10 and later, if configured and deployed
1768 CompactLogix; 1769 CompactLogix; CompactLogix 5370, 5380 and 5480
ControlLogix 5550, 5560, 5570, 5580 and 5590
DriveLogix 5730; FlexLogix 1794-L34
Compact GuardLogix 5370 and 5380; GuardLogix 5560, 5570 and 5580
SoftLogix 5800 - Fixed in
- No fix yet
- Since
- 5 Mar 2026
- Closed
- 10 Aug 2026
Timeline
- Update
Tenable’s updated review associated this flaw with Iranian-affiliated industrial-controller attacks. It also noted that CISA’s campaign advisory did not identify a specific exploited CVE, so that campaign link remains a research attribution.
- Vendor revisedNo fix yet
Rockwell revised its explanation and model-specific protections. It still marked the flaw uncorrected and said it could not be addressed with a patch.
- CISA added
CISA added CVE-2021-22681 to its Known Exploited Vulnerabilities catalogue, with a 26 March deadline for US federal civilian agencies to address it. Rockwell also acknowledged exploitation.
- Vendor revised
Rockwell added the 1783-CSP CIP Security Proxy as a protection option for CompactLogix installations. This was a hardware mitigation, not a patch.
- Made publicNo fix yet
Rockwell first disclosed CVE-2021-22681, an authentication weakness affecting Logix controllers and their engineering software.
Sources
- PN1550: Authentication Bypass Vulnerability Found in Logix ControllersRockwell Automation · 10 Mar 2026
- Rockwell Vulnerability Allowing Remote ICS Hacking Exploited in AttacksSecurityWeek · 6 Mar 2026
- Hikvision and Rockwell Automation CVSS 9.8 Flaws Added to CISA KEV CatalogThe Hacker News · 6 Mar 2026
- Coordinated cyberattack on U.S. water utilities: What you need to knowTenable · 10 Aug 2026