CVE-2026-9636

The record

A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections.

Affected packages

Related vulnerabilities

• CVE-2026-118696 In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3… CWE-299
• CVE-2026-115557 Python has added a denylist for known compromised certificates to the "ssl" module to… CWE-299
• CVE-2026-115570 Electron is a framework for writing cross-platform desktop applications using JavaScript… CWE-299
• CVE-2026-111943 On most platforms, Go uses the given system root certificates. CWE-299
• CVE-2026-86231 A security flaw has been discovered in mwiede jsch up to 2.28.5. CWE-299
• CVE-2026-61699 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-299
• CVE-2026-56821 Netty is an asynchronous, event-driven network application framework. CWE-299
• CVE-2026-6899 Check for certificate revocation only considers the first matching CRL and ignores other… CWE-299