CVE-2026-9292

Rockwell Automation FactoryTalk® DataMosaix™ Private Cloud - Stored Cross-Site Scripting

Assigner: Rockwell
Reserved: 22.05.2026 Published: 14.07.2026 Updated: 14.07.2026

A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.4

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	High
User Interaction	Passive

CVSS 4.0

Product Status

Vendor	Rockwell Automation
Product	FactoryTalk® DataMosaix™ Private Cloud
Versions	Default: unaffected Version Version 8.02 and below is affected

Vendor

Rockwell Automation

Product

FactoryTalk® DataMosaix™ Private Cloud

Versions

Default: unaffected

Version Version 8.02 and below is affected

Solutions

Upgrade to version 8.03 or later.

References

Problem Types