CWE-835 is the whole mechanism. A loop with an unreachable exit condition, per the advisory's own classification, means the controller does not drop a connection and carry on; it spins until the firmware declares a major nonrecoverable fault. Rockwell says corrupt crafted data is enough to trigger it.
The recovery line is where the cost sits, and it is not symmetric. A non-safety controller needs a stage 2 reset. A safety controller needs a program download. Both are deliberate acts by someone holding the project file, performed per controller, and neither is something a patch server does on your behalf. One malformed input buys the attacker a maintenance callout and, on the GuardLogix and Compact GuardLogix lines, a redownload of the safety program.
The version table is five product families against four firmware branches, which is twenty affected build entries: ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380 and CompactLogix 5480, each below 34.015, 35.014, 36.013 and 37.011. The lowest fixed build Rockwell lists is 34.015. Anything sitting on a branch older than 34 has no in-branch fix in this advisory and is looking at a major-branch move, with the validation and outage window that implies, rather than a point upgrade.
Then the date. The identifier is CVE-2021-42260 and the advisory is numbered in the 2026 ICSA series as ICSA-26-244-05, which puts roughly five years between the CVE reservation and this listing. The fix has existed for years across four branches. This is a firmware inventory problem: the number that matters to an asset owner is which of those four branches each rack is running, not the CVE age.
Rockwell reported the vulnerability to CISA itself. The advisory's Metrics heading carries no published CVSS score, and makes no claim of known exploitation or public exploit code. That combination puts this in the scheduling pile rather than the emergency pile, weighted by one question: whether the controller answers unsolicited traffic from anything beyond the control network. CISA's guidance is the standard set, keep control system devices off the internet, put them behind firewalls, isolate them from business networks, and use VPNs only where remote access is genuinely required.
For plants that cannot take the firmware, the only offered mitigation is Rockwell's security best practices, which governs who can reach the controller with corrupt data but leaves the loop itself in place. The products are deployed worldwide in critical manufacturing, so the population that has to make that trade is large and mostly running on outage calendars set months in advance.
