CVE-2026-9292

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9292", "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0", "state": "PUBLISHED", "assignerShortName": "Rockwell", "dateReserved": "2026-05-22T17:18:30.808Z", "datePublished": "2026-07-14T15:05:37.008Z", "dateUpdated": "2026-07-14T15:53:41.359Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b73dd486-f505-4403-b634-40b078b177f0", "shortName": "Rockwell", "dateUpdated": "2026-07-14T15:05:37.008Z"}, "title": "Rockwell Automation FactoryTalk\u00ae DataMosaix\u2122 Private Cloud - Stored Cross-Site Scripting", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "affected": [{"vendor": "Rockwell Automation", "product": "FactoryTalk\u00ae DataMosaix\u2122 Private Cloud", "versions": [{"status": "affected", "version": "Version 8.02 and below"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A Stored Cross-Site Scripting security issue exists within FactoryTalk\u00ae DataMosaix\u2122 Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A Stored Cross-Site Scripting security issue exists within FactoryTalk\u00ae DataMosaix\u2122 Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website."}]}], "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to version\u00a0\n8.03 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to version \n8.03 or later."}]}], "source": {"advisory": "SD1787", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T15:53:34.918087Z", "id": "CVE-2026-9292", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T15:53:41.359Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9292", "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0", "state": "PUBLISHED", "assignerShortName": "Rockwell", "dateReserved": "2026-05-22T17:18:30.808Z", "datePublished": "2026-07-14T15:05:37.008Z", "dateUpdated": "2026-07-14T15:53:41.359Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b73dd486-f505-4403-b634-40b078b177f0", "shortName": "Rockwell", "dateUpdated": "2026-07-14T15:05:37.008Z"}, "title": "Rockwell Automation FactoryTalk\u00ae DataMosaix\u2122 Private Cloud - Stored Cross-Site Scripting", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "affected": [{"vendor": "Rockwell Automation", "product": "FactoryTalk\u00ae DataMosaix\u2122 Private Cloud", "versions": [{"status": "affected", "version": "Version 8.02 and below"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A Stored Cross-Site Scripting security issue exists within FactoryTalk\u00ae DataMosaix\u2122 Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A Stored Cross-Site Scripting security issue exists within FactoryTalk\u00ae DataMosaix\u2122 Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website."}]}], "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to version\u00a0\n8.03 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to version \n8.03 or later."}]}], "source": {"advisory": "SD1787", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9292", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T15:53:34.918087Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T15:53:38.413Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FactoryTalk\u00ae DataMosaix\u2122 Private Cloud", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "Version 8.02 and below"}]}], "source": "PSIRT@rockwellautomation.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Stored Cross-Site Scripting security issue exists within FactoryTalk\u00ae DataMosaix\u2122 Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website."}, {"lang": "es", "value": "Un problema de seguridad de cross-site scripting almacenado existe dentro de FactoryTalk\u00ae DataMosaix\u2122 Private Cloud. La vulnerabilidad se deriva de una neutralizaci\u00f3n inadecuada de la entrada proporcionada por el usuario dentro de la configuraci\u00f3n de Workflows. Un atacante autenticado con privilegios elevados puede inyectar scripts maliciosos que se almacenan permanentemente en el servidor. Esta vulnerabilidad puede resultar en la ejecuci\u00f3n de JavaScript malicioso cuando otros usuarios acceden a la p\u00e1gina afectada, lo que podr\u00eda permitir la toma de control de cuentas, el robo de credenciales o la redirecci\u00f3n a un sitio web malicioso."}], "id": "CVE-2026-9292", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "PSIRT@rockwellautomation.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9292", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T15:53:34.918087Z", "version": "2.0.3"}}]}, "published": "2026-07-14T16:17:05.723", "references": [{"source": "PSIRT@rockwellautomation.com", "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html"}], "sourceIdentifier": "PSIRT@rockwellautomation.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "PSIRT@rockwellautomation.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.02]"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "FactoryTalk\u00ae DataMosaix\u2122 Private Cloud", "source": "cna", "vendor": "Rockwell Automation"}, "product": "factorytalk_datamosaix_private_cloud", "vendor": "rockwellautomation"}], "created": "2026-07-16T15:15:04.831452+00:00", "updated": "2026-11-11T01:15:05.424142+00:00", "vendors": ["rockwellautomation", "rockwellautomation$PRODUCT$factorytalk_datamosaix_private_cloud"]}