CVE-2026-6071: RCE in Rockwell Arena Simulation via Malicious…

Trend Micro's Zero Day Initiative disclosed CVE-2026-6071, an out-of-bounds write in Rockwell Automation Arena Simulation's DOE file parser that enables remote code execution. The flaw affects versions up to 16.20.08 and carries a CVSS v3.1 score of 7.8 and v4.0 score of 8.5. A patch is available.

On July 15, 2026, Trend Micro published advisory ZDI-26-438 detailing a remote code execution vulnerability in Rockwell Automation Arena Simulation, industrial simulation software used in the critical manufacturing sector. The flaw, cataloged as CVE-2026-6071, resides in the native DOE (Design of Experiments) file parser: an out-of-bounds write caused by a lack of user-supplied data validation allows heap memory corruption and arbitrary code execution in the context of the process. The coordinated disclosure cycle spanned approximately 14 months, from the initial vendor report on May 2, 2025, to public disclosure.

Key Takeaways

CVE-2026-6071 affects Rockwell Automation Arena Simulation up to version 16.20.08 and enables RCE via parsing of malicious DOE files
The vector requires user interaction: opening a DOE file or visiting a malicious web page, with CVSS 7.8 (v3.1) and 8.5 (v4.0)
The flaw is an out-of-bounds write in the native DOE parser, caused by missing bounds-checking on user-supplied data
Rockwell Automation has released a corrective patch; the CISA advisory confirms update availability for the critical manufacturing sector

The Technical Mechanism: When the DOE Parser Writes Out of Bounds

The vulnerability is rooted in the DOE file parser integrated into Arena Simulation. According to the ZDI advisory, "the specific flaw exists within the parsing of DOE files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object." This formulation precisely identifies the error class: an out-of-bounds write in heap memory, where the parser accepts user data without verifying its dimensional limits against the allocated buffer.

The consequence is arbitrary code execution in the context of the Arena Simulation process. The dossier does not specify whether the heap corruption can be channeled into particular exploitation techniques, nor does it detail the structure of the trigger DOE file. It also remains undocumented whether the parser shares components with other file formats supported by the software, a circumstance that could broaden the attack surface.

CVSS 7.8 vs. 8.5: The Discrepancy That Redefines the Risk Perimeter

The risk assessment presents a significant difference between metrics. ZDI assigns the vulnerability a CVSS v3.1 score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: a local attack with user interaction. CISA, in advisory ICSA-24-345-06, reports both vectors with scores of 7.8 (v3.1) and 8.5 (v4.0).

The discrepancy has operational relevance. An AV:L (Attack Vector: Local) vector implies the attacker must already have access to the target system, typically via a local file or internal network share. The ZDI formulation mentioning "remote attackers" accompanied by a user interaction condition introduces ambiguity: the term "remote" refers to the ability to deliver the payload, not necessarily to code execution over the network without intermediation. The dossier does not clarify whether a fully remote exploitation path exists, such as automatic download via browser without explicit file opening.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Arena Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file."
— ZDI Advisory ZDI-26-438

The Industrial Context: Why Arena Simulation Is a Sensitive Target

Arena Simulation is employed in modeling and optimizing production lines, supply chains, and complex industrial processes. Its prevalence in the critical manufacturing sector, as classified by CISA, positions the software in a domain where the availability and integrity of simulation models have direct impact on production planning and, by extension, operational continuity.

The DOE file vector is particularly relevant for the collaborative sharing typical of simulation environments: engineers, analysts, and external suppliers routinely exchange models and experimental configurations. This workflow exposes organizations to targeted spear-phishing, where a seemingly legitimate DOE file — received via email or downloaded from a shared repository — can deliver the payload without requiring further escalation.

The dossier does not document the number of exposed installations nor the presence of in-the-wild exploits. The CVE-2026-6071 record remains in "reserved" status on cve.org, with details not yet populated by the assigned CNA.

What to Do Now

Verify the installed version of Rockwell Automation Arena Simulation: installations up to 16.20.08 are vulnerable according to the CISA advisory
Apply the corrective update released by Rockwell Automation, confirmed available by both ZDI and CISA
Review policies for accepting external DOE files: restrict opening to verified sources and isolated simulation contexts where technically feasible
Monitor the CISA ICS repository for potential updates to advisory ICSA-24-345-06 that may extend operational guidance

The Lesson of 14 Months: Coordinated Disclosure and Technical Debt in Industrial Parsers

The timeline separating the May 2025 report from the July 2026 disclosure reflects the complexity of patching in industrial software: OT/ICS vendors must guarantee compatibility with existing models, customer configurations, and industry certifications, stretching remediation cycles beyond standard enterprise timelines. This interval, while not anomalous for the sector, leaves an exposure window measured in months during which the vulnerability is known to the vendor but not publicly documented.

The CVE-2026-6071 case highlights a recurring pattern: specialized file formats — often inherited from decades of engineering practice — lack modern sandboxing in their parsers. The missing bounds-checking validation is not new in the memory-corruption vulnerability landscape, but its presence in industrial design tools underscores how the technical debt of legacy formats continues to map to concrete risks for critical infrastructure.

The dossier does not document whether Rockwell Automation has introduced DOE parser isolation mechanisms in the patched versions, nor whether the update includes only the specific patch or a broader refactoring of memory management.

Information verified against cited sources and current as of publication.

Sources

Sources and references