Rockwell Arena RCE via Memory Corruption (CVE-2026-8085/8312-8314) Security Advisory

Vulnerability Overview Vulnerability Name: Arena® - Memory Corruption Vulnerability Severity: High CVE IDs: - CVE-2026-8085 - CVE-2026-8312 - CVE-2026-8313 - CVE-2026-8314 Release Date: July 14, 2026 Last Updated: July 14, 2026 Revision Number: 1.0 Known Exploited Vulnerability (KEV): No Fixed: Yes Workaround: No Scope of Impact Affected Product: Arena® Affected Versions: - V17.00.00 and earlier versions - V17.00.01 Remediation Fixed Version: V17.00.01 Workaround: For customers unable to upgrade to the fixed version, it is recommended to follow security best practices. Detailed Information CVE-2026-8085 Impact: A memory corruption vulnerability exists in Arena® Simulation within the component. The vulnerability arises from improper validation of user-supplied data, potentially leading to out-of-bounds writes. An attacker can exploit this vulnerability to execute arbitrary code by persuading a user to open a malicious file. CVSS 3.1 Base Score: 7.8/10 CVSS 4.0 Base Score: 7.0/10 CWE: CWE-787: Out-of-bounds Write CVE-2026-8312 Impact: A memory corruption vulnerability exists in Arena® Simulation within the component. The vulnerability arises from improper validation of user-supplied data, potentially leading to out-of-bounds writes. An attacker can exploit this vulnerability to execute arbitrary code by persuading a user to open a malicious file. CVSS 3.1 Base Score: 7.8/10 CVSS 4.0 Base Score: 7.0/10 CWE: CWE-787: Out-of-bounds Write CVE-2026-8313 Impact: A memory corruption vulnerability exists in Arena® Simulation within the component. The vulnerability arises from improper validation of user-supplied data, potentially leading to out-of-bounds writes. An attacker can exploit this vulnerability to execute arbitrary code by persuading a user to open a malicious file. CVSS 3.1 Base Score: 7.8/10 CVSS 4.0 Base Score: 7.0/10 CWE: CWE-787: Out-of-bounds Write CVE-2026-8314 Impact: A memory corruption vulnerability exists in Arena® Simulation within the component. The vulnerability arises from improper validation of user-supplied data, potentially leading to out-of-bounds writes. An attacker can exploit this vulnerability to execute arbitrary code by persuading a user to open a malicious file. CVSS 3.1 Base Score: 7.8/10 CVSS 4.0 Base Score: 7.0/10 CWE: CWE-787: Out-of-bounds Write Additional Information Revision History: - 1.0: July 14, 2026, Initial release Glossary: - Arbitrary Code Execution: The ability of an attacker to run any command or code of their choice on the target machine or within the target process. Get the Latest Product Security Information: - Visit the Rockwell Automation Security Advisories page. - Subscribe to Product Security Alerts. - View the latest list of Rockwell Automation Security Advisories. - Report potential security issues with Rockwell Automation products. - Learn more about the vulnerability policy. Support: - For any questions regarding the above security issues and mitigation measures, please contact TechConnect. - More information can be found on the Contact Us - For any questions regarding this disclosure, please contact PSIRT. - Email: rsec@gra.rockwell.com Legal Disclaimer: - Rockwell Automation does not guarantee the integrity, timeliness, or accuracy of the data contained on this website. - All information is provided "as is," and Rockwell Automation is not responsible for any direct or indirect losses. - Some jurisdictions do not allow the exclusion of implied warranties, so this disclaimer may not apply to you.

Goal Reached Thanks to every supporter — we hit 100%!

Rockwell Arena RCE via Memory Corruption (CVE-2026-8085/8312-8314) Security Advisory