Summary
- Rockwell advisory SD1801 was published on 13 October 2026.
- The affected product is the 1732E ArmorBlock industrial I/O module.
- Firmware 3.013 corrects the reported issues for affected 3.012-and-earlier installations.
Rockwell Automation has released a security advisory and corrective firmware for vulnerabilities in its 1732E ArmorBlock industrial input/output modules. Published on 13 October 2026, advisory SD1801 covers CVE-2026-12655 and CVE-2026-12656, and identifies product revisions requiring updates.
The affected equipment comprises rugged, on-machine distributed I/O modules that connect sensors and actuators through EtherNet/IP and provide an integrated web interface for management. Unlike a general-purpose server, an I/O module can sit close to production equipment and become part of the communications path for control signals. Its security needs to be understood in relation to the surrounding network and the process it supports.
Rockwell's affected-product table lists firmware 3.012 and earlier for the relevant 1732E modules, with firmware 3.013 providing the correction. The manufacturer describes a password-management weakness among the issues. Users should verify catalogue number and firmware against the complete advisory because product families may include variants not covered by the same update.
The vendor classifies the advisory as high severity and states that it is not a known exploited vulnerability. That is important context: a public description of possible unauthorised activity does not establish that any plant has suffered an intrusion or process disruption. Exploitability will depend on the precise weakness, access path and configuration of the affected module.
Remote configuration interfaces help engineering staff commission and maintain distributed devices, particularly where physical access is difficult. They also introduce a management surface that must be separated from ordinary production traffic and controlled according to the privileges required for maintenance. A weakness involving passwords may undermine the expected separation between authorised configuration and unauthorised changes.
In industrial environments, unauthorised changes to device configuration can be disruptive even if no confidential information is copied. An attacker capable of altering device settings might impair the availability or correctness of information exchanged with upstream systems, although the advisory does not establish that either CVE enables arbitrary plant control in every configuration. Such consequences require an assessment of the actual installation and its protective architecture.
Applying a firmware update can require scheduling with operations and engineering personnel, because a module may serve equipment that cannot be interrupted without production consequences. Rockwell's publication allows asset owners to identify affected components, obtain corrected software and assess whether interim network restrictions are needed while the maintenance window is arranged.
Rockwell's advisory provides the strongest evidence on the product and correction, rather than public accounts of attacks. It records an internal discovery route, identifies affected firmware and marks the issues as corrected. That is different from evidence of a security incident at a plant. Engineering teams can use that level of detail to distinguish affected stock held as spares from modules installed in operating machines, and to plan the order of maintenance. The on-machine design of the hardware may add physical access and availability considerations, while the integrated webserver makes network reachability and device configuration relevant to the assessment. Neither the presence of a web interface nor the vulnerability rating establishes that a device is reachable from the public internet.
Unlike a broad warning about remote-access software, the advisory gives a named hardware family and corrected firmware level. That specificity should allow owners to check purchase and engineering records against installed devices. The manufacturer has not announced a new product recall or general shutdown requirement, and the published record does not justify assuming that unrelated Rockwell controllers are affected.
The manufacturer says the issues were identified during routine internal testing. That discovery route differs from an incident response disclosure, and the notice provides no basis for naming an attacker or alleging active exploitation. Organisations using the affected modules can use advisory SD1801 and the corrected firmware version to document the resolution status of their particular devices.
