Manager - Process Excellence

Rockwell Automation reported third-quarter fiscal 2026 results that exceeded Wall Street expectations, but shares fell more than 4% in pre-market trading. The company posted adjusted earnings of $3.49 per share, beating the analyst consensus of $3.38, while revenue increased 8% year-over-year to $2.31bn, surpassing expectations of $2.24bn. Despite the strong quarterly performance, investors appeared disappointed with the company's updated guidance. Rockwell revised its fiscal 2026 adjusted earnings outlook to a range of $13.00 to $13.30 per share, with the midpoint of $13.15 broadly in line with expectations. The company raised its full-year sales growth forecast to between 7.5% and 9.5%, up from its previous outlook of 5% to 9%. Enterprise operating margin expanded to 22.3% from 19.5% a year earlier.

Rockwell Automation reported second-quarter revenue of $2.31 billion, beating analyst estimates of $2.25 billion and marking 7.9% year-on-year growth. The industrial automation company's non-GAAP profit of $3.49 per share exceeded consensus estimates by 3.2%. The company raised its full-year revenue guidance to $9 billion from $8.9 billion and increased its adjusted earnings per share forecast to $13.15 at the midpoint. Operating margin improved to 22.3% from 17.6% in the prior-year quarter, whilst free cash flow margin rose to 28.3% from 22.8%. Organic revenue grew 10% year on year. However, Rockwell's recent performance shows slowing demand, with annualised revenue growth of 1% over the past two years, below its five-year compound annual growth rate of 5.8%.

Rockwell Arena Simulation flaws: detection and hardening guide. Security Arsenal Team July 26, 2026 Rockwell Automation has released patches for critical code execution vulnerabilities identified in its Arena Simulation Software. As a staple in discrete event simulation for industrial engineering, Arena is frequently used to model complex manufacturing and supply chain processes. The exploitation of these flaws poses a significant risk to OT environments, where compromised engineering workstations can serve as a pivot point into the industrial control system (ICS) network. Defenders must treat this advisory with high urgency, prioritizing patch management on assets connected to the industrial network. Technical analysis. Affected Products: * Rockwell Automation Arena Simulation Software (All versions prior to the latest patch release). Vulnerability Overview: The identified vulnerabilities are classified as Remote Code Execution (RCE) flaws. While specific CVE identifiers are detailed in the vendor advisory, the core technical issue revolves around the improper handling of files - specifically project files (often utilizing .doe or proprietary extensions associated with Arena models). Attack Vector: The attack requires user interaction; an attacker must trick a legitimate user - such as a process engineer or simulation specialist - into opening a maliciously crafted file. This is typically achieved through phishing campaigns or by depositing the file into a shared network drive where simulation models are exchanged. Exploitation Mechanics: When the vulnerable version of Arena parses the malicious file, a memory corruption condition (such as a buffer overflow or use-after-free) occurs. This allows the attacker to bypass Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR) on the target workstation, executing arbitrary code with the privileges of the logged-in user. Impact: Successful exploitation grants the attacker full control over the engineering workstation. From this vantage point, the attacker can move laterally to the control network, manipulate simulation data to disrupt decision-making, or deploy ransomware tailored for industrial environments. Detection & response. Detecting exploitation of simulation software requires monitoring for abnormal process behaviors on engineering workstations. Security Arsenal, LLC has developed the following detection logic to identify potential compromise attempts. SIGMA rules. - title: Suspicious Child Process Spawning by Rockwell Arena id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f status: experimental description: Detects Rockwell Arena spawning unauthorized command shells, potentially indicating exploitation of code execution flaws. author: Security Arsenal date: 2026/04/22 references: - https://www.securityweek.com/rockwell-patches-code-execution-flaws-in-arena-simulation-software/ tags: - attack.execution - attack.t1204 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\Arena.exe' Image|endswith: - '\cmd.exe' - '\powershell.exe' - '\pwsh.exe' condition: selection falsepositives: - Legitimate administrative scripting by engineers (low volume) level: high - title: Network Connection by Arena Simulation Process id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d status: experimental description: Detects uncommon network connections initiated by the Arena process, which may indicate reverse shell activity or data exfiltration. author: Security Arsenal date: 2026/04/22 references: - https://attack.mitre.org/techniques/T1071/ tags: - attack.command_and_control - attack.t1071 logsource: category: network_connection product: windows detection: selection: Image|endswith: '\Arena.exe' Initiated: 'true' DestinationPort|notin: - '80' - '443' - '27000' # Common licensing port, check environment specifics condition: selection falsepositives: - License server checks - Cloud-based simulation features (if enabled) level: medium KQL (Microsoft Sentinel). KQL - Microsoft Sentinel / Defender // Hunt for suspicious child processes spawned by Arena DeviceProcessEvents | where InitiatingProcessFileName =~ "Arena.exe" where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe") | project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath | order by Timestamp desc Velociraptor VQL. VQL - Velociraptor - Hunt for Arena process spawning shells SELECT Pid, Name, CommandLine, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Username FROM pslist WHERE Parent.Name =~ "Arena.exe" AND Name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe") Remediation Script (powershell). PowerShell # Script to check installed version of Arena and alert if vulnerable # Note: Update the $MinimumSafeVersion variable based on the official Rockwell advisory $MinSafeVersion = [version]"16.00.00" # EXAMPLE VERSION - VERIFY WITH VENDOR ADVISORY $RegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" $InstalledApps = Get-ItemProperty $RegPath $ArenaInstall = $InstalledApps | Where-Object {$_.DisplayName -like "*Arena*" -and $_.Publisher -like "*Rockwell*"} if ($ArenaInstall) {Write-Host "[+] Found Rockwell Arena Installation:" -ForegroundColor Cyan Write-Host " Display Name: $($ArenaInstall.DisplayName)" Write-Host " Install Location: $($ArenaInstall.InstallLocation)" Write-Host " Version: $($ArenaInstall.DisplayVersion)" try { $CurrentVersion = [version]$ArenaInstall.DisplayVersion if ($CurrentVersion -lt $MinSafeVersion) { Write-Host "[!] ALERT: Installed version is vulnerable. Update immediately." -ForegroundColor Red} else {Write-Host "[OK] Version appears to be patched." -ForegroundColor Green}} catch {Write-Host "[!] Could not parse version number. Manual verification required." -ForegroundColor Yellow}} else {Write-Host "[-] Rockwell Arena not detected via standard registry keys." -ForegroundColor Gray} Remediation. 1. Patch Immediately: Review the official Rockwell Automation security advisory (typically referenced as a Security Bulletin) and download the latest version of Arena Simulation Software. Apply the patch to all engineering workstations, including those used by contractors or third-party integrators. 2. Restrict File Execution: If immediate patching is not possible, enforce strict application whitelisting (e.g., AppLocker) to prevent Arena from spawning unauthorized child processes like cmd.exe or powershell.exe. 3. Email and Web Filtering: Block incoming email attachments with .doe extensions and other Arena-specific file types from external sources. Implement Mark-of-the-Web (MOTW) policies to prevent these files from executing macros or scripts if downloaded from the internet. 4. Network Segmentation: Ensure that engineering workstations running simulation software are isolated from the critical ICS network (PLC/SCADA layer) via a DMZ or tightly controlled firewall rules. Related resources. managed-soc mdr security-monitoring threat-detection siem rockwell-automation ics-security arena-simulation rce ot-security Is your security operations ready? Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.