Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module

CISA reports a vulnerability (CVE-2026-9636) in Rockwell Automation CompactLogix 5380, ControlLogix 5580, GuardLogix variants and 1756-EN4TR modules where improper Certificate Revocation List (CRL) handling can allow revoked intermediate certificates to be accepted, potentially enabling CIP Security bypass and denial-of-service; affected firmware versions are listed and CISA provides recommended mitigations, with no known active exploitation reported.