CVE-2021-27475

8.6 highEPSS 3.0%

High (8.6) in rockwellautomation connected components workbench. EPSS 3.0% chance of exploitation in the next 30 days.

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.

Severity

CVSS 3.1

8.6 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2022-03-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rockwellautomation:connected_components_workbench

References

https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435
https://www.cisa.gov/uscert/ics/advisories/icsa-21-133-01
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435
https://www.cisa.gov/uscert/ics/advisories/icsa-21-133-01

Check your stack JSON