CVE-2021-22681

CVE-2021-22681 is a critical-severity (CVSS 9.8) vulnerability in Rockwell Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalog on March 5, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 26, 2026. CISA does not currently list it as used in ransomware campaigns.

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03
• https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22681