Rockwell patches code-execution bugs in Arena Simulation

Rockwell Automation released a patch for four high‑severity memory corruption vulnerabilities in its Arena Simulation software. The flaws affect Arena versions up to and including 17.00.00 and were fixed in version 17.00.01.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Rockwell described the issues as out-of-bounds write conditions caused by improper validation of user-supplied data. The four CVE identifiers are CVE-2026-8085, CVE-2026-8312, CVE-2026-8313 and CVE-2026-8314. Successful exploitation could allow arbitrary code execution in the context of the Arena process.

Exploitation requires user interaction. An attacker would need to deliver a specially crafted Arena model or experiment file and persuade a user to open it; the advisories state the flaws cannot be exploited remotely without that action.

Researcher Michael Heinzl reported he identified 17 distinct vulnerabilities across Arena components. Rockwell grouped related issues by affected component and published the four CVEs. Heinzl noted that Arena model and experiment files are commonly opened during normal workflows, which could make a crafted file less likely to appear suspicious to targeted users.

CISA and Rockwell indicate there is no evidence the vulnerabilities have been exploited in the wild. Rockwell issued version 17.00.01 to address the memory validation errors and urged customers to install the update.

Arena Simulation is discrete-event simulation software used to model and test operational workflows before deployment. Rockwell materials list users in supply chain firms, hospitals and defense contractors. Because code execution would run with the Arena process’s privileges, whether an attacker could reach other systems depends on how organizations have isolated Arena and configured network and access controls.

Administrators running Arena should upgrade to 17.00.01. Other mitigations include restricting the opening of untrusted files, running the Arena process with least privilege and applying network segmentation to reduce opportunities for lateral movement. Rockwell and CISA continue to publish guidance in their advisories.