CVE-2026-9292: FactoryTalk DataMosaix Stored XSS Flaw

CVE-2026-9292 Overview

CVE-2026-9292 is a stored Cross-Site Scripting (XSS) vulnerability in Rockwell Automation's FactoryTalk® DataMosaix™ Private Cloud. The flaw resides in the Workflows configuration component, where user-supplied input is not properly neutralized before being stored and rendered. An authenticated attacker with high privileges can inject malicious JavaScript that persists on the server. When other users access the affected page, the injected script executes in their browser context. Successful exploitation can lead to account takeover, credential theft, or redirection to attacker-controlled sites. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Persistent JavaScript execution in victim browsers enables session hijacking, credential theft, and unauthorized actions within FactoryTalk DataMosaix Private Cloud industrial workflow environments.

Affected Products

Rockwell Automation FactoryTalk® DataMosaix™ Private Cloud
Workflows configuration component
Industrial cloud environments running affected DataMosaix versions

Discovery Timeline

2026-07-14 - CVE-2026-9292 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-9292

Vulnerability Analysis

The vulnerability exists in the Workflows configuration interface of FactoryTalk DataMosaix Private Cloud. The application accepts user-supplied input and stores it without applying output encoding or input sanitization. When another authenticated user loads a page that renders the stored data, the browser interprets the injected payload as executable JavaScript.

Because the payload is stored server-side, exploitation is persistent and affects every user who views the compromised page. This differs from reflected XSS, which requires per-victim delivery. In an operational technology (OT) environment, script execution in an administrator's session can pivot to workflow manipulation, configuration changes, or exposure of sensitive process data.

The attacker requires high privileges to inject the payload, which limits the pool of potential threat actors to insiders or attackers who have already compromised a privileged account. User interaction is required to trigger the payload, since a victim must load the affected page.

Root Cause

The root cause is improper neutralization of user-supplied input within Workflows configuration fields. The application fails to validate, sanitize, or encode input before persisting it and before rendering it back to the DOM. This is a classic [CWE-79] weakness pattern where trust boundaries between stored data and rendered output are not enforced.

Attack Vector

Exploitation follows a standard stored XSS pattern. An authenticated attacker with high privileges accesses the Workflows configuration interface. The attacker submits a payload containing JavaScript within a vulnerable field. The server stores the payload without sanitization. When a subsequent user, potentially an administrator, loads the affected view, the browser executes the script under that user's session context. The attacker can then exfiltrate session tokens, submit forged requests, or redirect the victim to a malicious host.

No verified proof-of-concept code has been published. Refer to the Rockwell Automation Security Advisory SD1787 for vendor-provided technical details.

Detection Methods for CVE-2026-9292

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or HTML event handler attributes stored in Workflows configuration records
Outbound browser requests from privileged user sessions to unfamiliar external domains after loading Workflows pages
Anomalous session token access patterns or session reuse from unexpected IP addresses following administrator page loads
Modifications to Workflows configuration by accounts that do not typically perform such changes

Detection Strategies

Review Workflows configuration fields for HTML or JavaScript syntax that should not appear in legitimate operational data
Inspect web server and application logs for POST or PUT requests to Workflows endpoints containing script tags or encoded payloads
Correlate privileged account activity with subsequent anomalous browser behavior from administrator workstations
Monitor Content Security Policy (CSP) violation reports if CSP headers are configured on the DataMosaix front-end

Monitoring Recommendations

Enable audit logging for all changes to Workflows configuration and forward logs to a centralized SIEM
Alert on high-privilege account modifications to Workflows outside of approved change windows
Baseline normal administrator browser traffic and flag deviations following access to DataMosaix pages
Track authentication anomalies for accounts that recently accessed potentially compromised Workflows views

How to Mitigate CVE-2026-9292

Immediate Actions Required

Apply the vendor patch referenced in Rockwell Automation Security Advisory SD1787 as soon as it is available for your deployment
Audit all existing Workflows configuration entries for suspicious HTML or JavaScript content and remove any unauthorized payloads
Rotate credentials and session tokens for any privileged accounts that may have interacted with compromised pages
Restrict Workflows configuration privileges to the minimum set of administrators required for operations

Patch Information

Rockwell Automation has published Security Advisory SD1787 addressing CVE-2026-9292. Consult the advisory for the specific fixed versions of FactoryTalk DataMosaix Private Cloud and vendor-recommended upgrade procedures. Apply the update through your standard change management process for OT environments.

Workarounds

Enforce least privilege by removing high-privilege access from accounts that do not require Workflows configuration rights
Implement network segmentation to limit browser access to the DataMosaix management interface from trusted administrator workstations only
Deploy a Content Security Policy at the reverse proxy or web application firewall layer to restrict inline script execution
Require multi-factor authentication for all privileged DataMosaix accounts to reduce the risk of attacker-controlled privileged sessions

bash

# Example CSP header enforced at a reverse proxy fronting DataMosaix
# Blocks inline scripts and restricts script sources to the application origin
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'" always;