CISA warns of stored XSS flaw in Rockwell Automation DataMosaix Private Cloud

By Atlas Watchline Staff · Regulatory · July 26, 2026

CISA says a stored cross-site scripting flaw in Rockwell Automation FactoryTalk DataMosaix Private Cloud could let a privileged authenticated attacker store malicious scripts on a server.

CISA published an advisory on July 16 about a stored cross-site scripting vulnerability in Rockwell Automation FactoryTalk DataMosaix Private Cloud, identifying the flaw as CVE-2026-9292.

The advisory says the issue affects version 8.02 and earlier and could let an authenticated attacker with high privileges store malicious scripts on the server. Those scripts may run when other users view the affected page, creating risks that include account takeover, credential theft and redirection to a malicious website.

CISA assigned the issue a CVSS v3.1 base score of 6.1, which it lists as medium, and a CVSS v4.0 base score of 8.4, which it lists as high.

CISA said the flaw stems from improper neutralization of user-supplied input in the Workflows configuration. The advisory says Rockwell Automation reported the vulnerability to CISA and that no known public exploitation specifically targeting the flaw had been reported at the time of publication.

Rockwell Automation recommends upgrading to DataMosaix Private Cloud version 8.03 or later. If users cannot upgrade, CISA relays the company’s guidance to follow Rockwell Automation’s security best practices and refer to Security Advisory SD1787 for more information.

The advisory says the affected product is used in critical manufacturing and information technology settings and is deployed worldwide.

Sources

• CISA Cybersecurity Advisory ICSA-26-197-09

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.