# Stored XSS in Rockwell DataMosaix Threatens Manufacturing Control Systems
## The Threat
Rockwell Automation has disclosed a stored cross-site scripting (XSS) vulnerability in FactoryTalk DataMosaix Private Cloud that allows authenticated attackers to inject malicious scripts directly into the server. Once injected via the Workflows configuration interface, these scripts execute persistently whenever other authorized users access the affected page—creating a vector for account compromise, credential harvesting, and operational disruption within critical manufacturing environments.
Stored XSS vulnerabilities are particularly dangerous in industrial control systems because they operate in contexts where user trust is already implicit. Factory floor operators, plant engineers, and system administrators expect that dashboards and configuration interfaces are legitimate—the persistent nature of a stored attack means no single user action can be relied upon to catch it. An attacker with sufficient privileges could inject malicious code that silently exfiltrates credentials from every person who logs in, captures session tokens, or redirects users to fake login pages to harvest authentication material.
The vulnerability stems from inadequate input sanitization in the Workflows configuration module. Because FactoryTalk DataMosaix is often the nerve center of industrial operations—collecting, displaying, and acting upon real-time production data—compromise of the system itself represents a stepping stone to broader operational technology (OT) environment attacks.
## Severity and Impact
| Aspect | Details |
|--------|---------|
| CVE Identifier | CVE-2026-9292 |
| CVSS v3.1 Score | 6.1 (MEDIUM) |
| CVSS v4.0 Score | 8.4 (HIGH) |
| Vector String (v3.1) | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N |
| Vector String (v4.0) | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privilege Required | High |
| User Interaction | Required |
| Weakness Classification | CWE-79 (Improper Neutralization of Input During Web Page Generation) |
| Impact | Confidentiality High, Integrity High, Availability None |
The escalation from CVSS 6.1 to 8.4 between scoring versions reflects a more nuanced assessment of the threat landscape. While the vulnerability does require high-level privilege to inject and user interaction to trigger, the combination of network accessibility, low attack complexity, and dual impact on confidentiality and integrity has elevated the risk rating.
## Affected Products
Rockwell Automation FactoryTalk DataMosaix:
## Mitigations
Immediate action required:
## References
---
## HackWire Analysis
The jump from CVSS 6.1 to 8.4 is the headline story here. When the National Institute of Standards and Technology introduced CVSS v4.0 last year, it promised better precision in threat scoring—and this vulnerability is evidence of that recalibration at work. What CVSS v3.1 rated as moderate risk, v4.0 now flags as high. The reevaluation suggests that security analysts increasingly view stored XSS in operational dashboards as carrying disproportionate weight compared to older scoring systems.
The second angle worth watching: the requirement for high privilege to inject is a mitigating factor that shouldn't create false comfort. In manufacturing environments, admin accounts are often shared, credentials are cached on workstations, and—critically—contractors and IT consultants regularly hold these privileges during implementation and upgrades. A single compromised admin account in the supply chain gives an attacker persistence within the control system that survives the contract end date.
Stored XSS in industrial control software is not new, but it's becoming *more visible*. As OT vendors shift toward cloud-based management interfaces and move away from air-gapped architectures, web application vulnerabilities that were once confined to IT networks now threaten the availability and integrity of production systems. FactoryTalk DataMosaix is specifically designed to centralize visibility across distributed plants—which means one compromised instance can grant attackers a foothold across entire manufacturing operations.
Defenders need to approach this not as a "wait for v8.03" moment but as a forcing function: if you're running FactoryTalk on version 8.02, your patch window just became a priority. If you're evaluating Rockwell solutions, this is a test case for how the vendor has matured its secure development practices. And if you're responsible for manufacturing infrastructure more broadly, CVE-2026-9292 is a reminder that the same XSS attack patterns that plague consumer web applications are now circulating in industrial environments with real operational consequences.
— *HackWire Editorial*
## Related Coverage