Skip to main content
Apexward Pulse
Type Vulnerability

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

1 sourceCVE-2021-22681

At a glance

High
Suggested 24-hour window, counted from the last update
ActiveConfirmed in-the-wild exploitation
Evidence-weighted, not popularity
Signal

Actively exploited in the wild — prioritise confirming exposure.

Why High

High rather than Critical: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Apple Multiple Products, treat it as Critical.

Briefing

  • Do not treat uncorroborated claims as confirmed breaches.

Questions to ask IT

  • Do we run Apple Multiple Products, and which versions?
  • Is any of it reachable from the internet?
  • Have we checked whether it has already been used against us?
  • If it is still not patched, what mitigation is in place, and what is holding the fix up?

Next steps

  1. Confirm exposure, mitigation status and any service interruption risk.

Summary

  • Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorised application to connect with Logix controllers.
  • CVE-2021-22681 is listed in known-exploited catalogue (exploitation in the wild)
  • 7% estimated chance of exploitation in 30 days; 98.
  • Authoritative catalogues report active exploitation of this vulnerability.

Why this matters in the UK

  • Known-exploited catalogue reports exploitation in the wild

Products and services involved

13 reports

Part of Apple vulnerabilities and exploitation

All 13 reports in this story

Pulse

Last checked 4d ago · Recheck overdue since 5 Nov 2026, 21:37 UK time

Update
4 Nov 2026, 21:37 UK time · 4d ago

held at 50.7%; ranking metadata was updated.

Listed on the — prioritise confirming exposure and patching.

EscalationDe-escalationCritical / liveWhat these mean
Drag to pan · Ctrl / ⌘ + scroll or pinch to zoom11 events

Sources

How we know

Statements extracted from sources. Higher confidence means stronger corroboration.

  • ConfirmedHeadline90% confidence

    Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

  • ConfirmedSummary fact75% confidence

    Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorised application to connect with Logix controllers. To leverage this vulnerability, an unauthorised user would require network access to the controller.

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2021-22681

  • ConfirmedKnown-exploited catalogue98% confidence

    CVE-2021-22681 is listed in known-exploited catalogue (exploitation in the wild)

  • ConfirmedEstimated attack likelihood95% confidence

    CVE-2021-22681 has estimated attack likelihood 0.50712 (~50.7% estimated chance of exploitation in 30 days; 98.8th percentile) as of 2026-07-31 — probability signal, not confirmed exploitation