According to advisories released by CISA and Rockwell, Rockwell Automation has fixed four vulnerabilities in its Arena Simulation software that could allow an attacker to execute arbitrary code on an affected system.
Arena Simulation is discrete event simulation software that provides companies with a virtual environment to model, visualize and test complex operations, allowing them to identify problems and evaluate process changes before implementing them in production.
The four high-severity vulnerabilities – CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, and CVE-2026-8314 – are memory corruption issues that result from improper validation of user-supplied data and could result in an out-of-bounds write.
SecurityWeek launches Critical Impact Awards to recognize excellence in industrial cybersecurity
A successful exploitation could allow an attacker to execute arbitrary code in the context of the current process. Arena versions up to and including 5:00 p.m. are affected. Rockwell fixed the vulnerabilities in version 17.00.01.
Without user interaction, remote exploitation is not possible – an attacker would have to trick a user into opening a malicious file to trigger one of the four bugs.
Michael Heinzl, the researcher who discovered the vulnerabilities, said Safety Week that the file types involved (Arena experiment and model files) are routinely opened by users as part of normal workflows, meaning that a booby-trapped file would not necessarily be noticeable to an Arena user who is the target of a social engineering attempt.
When asked what an attacker could realistically achieve, given that Arena is simulation software and not a live industrial control system (ICS), the researcher responded that code execution was limited to the same permissions as the Arena process itself. Whether an attacker could move from there to more sensitive systems depends on how a company has deployed and segmented Arena on its network.
The researcher also noted that Arena’s broad footprint is one reason the flaws matter, even though the software doesn’t directly control physical processes, pointing to Rockwell’s own customer materials detailing adoption at leading global supply chain companies, hospitals in multiple countries and organizations such as defense contractors.
The assessments published by CISA and Rockwell indicate that there is no evidence of exploitation in the wild.
Heinzl noted that he actually identified 17 different vulnerabilities in Arena, but Rockwell decided to group them by the affected component, which resulted in only four CVEs being assigned.
The researcher has published 17 guides on his personal website.
Related: USA warns of Iranian hackers targeting ICS devices from Siemens, Schneider and Rockwell
Related: Legacy Systems, Real Impact: The Reality of OT Security
Related: New controller bugs expose highway signs and billboards to remote hacking
https://www.securityweek.com/rockwell-patches-code-execution-flaws-in-arena-simulation-software/
