Stored XSS in FactoryTalk DataMosaix Private Cloud Workflows

Executive Summary

CVE-2026-9292 is a Stored Cross-Site Scripting (XSS) vulnerability in Rockwell Automation's FactoryTalk DataMosaix Private Cloud software versions 8.02 and below. The issue occurs due to improper neutralization of user-supplied input within the Workflows configuration.

An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. When other users access the affected page, the injected JavaScript executes in their browsers.

• The vulnerability affects FactoryTalk DataMosaix Private Cloud software.
• It requires high privileges for exploitation.
• Malicious scripts are stored on the server and execute when other users access the affected page.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your system is running an affected version of FactoryTalk DataMosaix Private Cloud (versions 8.02 and below). Since this is a Stored Cross-Site Scripting (XSS) vulnerability in the Workflows configuration, detection involves verifying the software version and inspecting the application for signs of malicious script injection.

• Check the installed version of FactoryTalk DataMosaix Private Cloud. If it is version 8.02 or below, the system is vulnerable.
• Review the Workflows configuration for any unusual or unauthorized scripts. This may require manual inspection of the configuration files or database entries where user-supplied input is stored.
• Monitor network traffic and logs for suspicious activity, such as unexpected script execution or unauthorized access to the Workflows configuration page.
• Use vulnerability scanning tools that support Rockwell Automation products to detect the presence of this CVE. Ensure the tool is updated with the latest vulnerability signatures.

There are no specific commands provided in the context for detecting this vulnerability, as it primarily involves version verification and manual inspection of the application configuration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts if exploited by an attacker.

• Account takeover: The attacker could gain control of other users' accounts.
• Credential theft: Sensitive information like usernames and passwords could be stolen.
• Redirection to malicious websites: Users could be redirected to sites designed to further exploit their systems or steal data.

The impact is particularly severe for organizations using the affected software, as it could lead to unauthorized access to critical systems and data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with several common standards and regulations, depending on the context of its exploitation.

• GDPR: If the vulnerability leads to unauthorized access or theft of personal data of EU citizens, it could result in a violation of GDPR. Organizations may face significant fines and be required to notify affected individuals.
• HIPAA: For organizations handling protected health information (PHI), exploitation of this vulnerability could lead to unauthorized access to PHI, resulting in a HIPAA violation. This could incur penalties and require breach notifications.

The specific impact on compliance depends on the nature of the data handled by the affected system and the regulatory requirements applicable to the organization.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade FactoryTalk DataMosaix Private Cloud to version 8.03 or later, as this version contains the fix for the vulnerability.
• If upgrading is not immediately possible, restrict access to the Workflows configuration to only trusted users with high privileges. Ensure that all users with access are authenticated and authorized.
• Monitor the Workflows configuration for any unauthorized changes or injected scripts. Regularly audit the configuration to ensure no malicious scripts have been added.
• Educate users about the risks of XSS attacks and advise them to avoid clicking on suspicious links or accessing untrusted pages within the application.
• Implement network-level protections, such as web application firewalls (WAFs), to detect and block XSS attacks targeting the application.

Useful 0 Not Useful 0