VulnHub

Real-time Cybersecurity News

Critical

Rockwell Automation FactoryTalk DataMosaix

All CISA Advisories
PhishingCVEVulnerabilityCritical

Overview

A serious vulnerability has been identified in Rockwell Automation's FactoryTalk DataMosaix Private Cloud software, affecting versions up to 8.02. This flaw, classified as CVE-2026-9292, allows authenticated attackers to inject malicious scripts into the server due to improper handling of user input. If exploited, this could lead to account takeovers, credential theft, or redirection to harmful websites when other users access the compromised pages. Rockwell Automation recommends that users upgrade to version 8.03 or later to mitigate the risk. For those unable to upgrade, following security best practices outlined by Rockwell is advised. Although there have been no reports of active exploitation of this vulnerability, organizations are urged to enhance their security measures to protect against potential threats.

Key Takeaways

  • Affected Systems: Rockwell Automation FactoryTalk DataMosaix Private Cloud versions <=8.02
  • Action Required: Users should upgrade to FactoryTalk DataMosaix Private Cloud version 8.
  • Timeline: Disclosed on 2026-07-16

Original Article Summary

View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious scripts on the server. The following versions of Rockwell Automation FactoryTalk DataMosaix are affected: DataMosaix Private Cloud <=8.02 (CVE-2026-9292) CVSS Vendor Equipment Vulnerabilities v3 6.1 Rockwell Automation Rockwell Automation FactoryTalk DataMosaix Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Background Critical Infrastructure Sectors: Critical Manufacturing, Information Technology Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-9292 A Stored Cross-Site Scripting security issue exists within FactoryTalk DataMosaix Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website. View CVE Details Affected Products Rockwell Automation FactoryTalk DataMosaix Vendor: Rockwell Automation Product Version: Rockwell Automation DataMosaix Private Cloud: <=8.02 Product Status: known_affected Remediations Vendor fix Rockwell Automation recommends users to upgrade to the following: DataMosaix Private Cloud versions 8.03 or later. Mitigation Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight). https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight Mitigation For more information, see Rockwell Automation Security Advisory SD1787 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html). https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Metrics CVSS Version Base Score Base Severity Vector String 3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N 4.0 8.4 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Acknowledgments Rockwell Automation reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. Revision History Initial Release Date: 2026-07-16 Date Revision Summary 2026-07-16 1 Initial Republication of Rockwell Automation Security Advisory SD1787 Legal Notice and Terms of Use

Impact

Rockwell Automation FactoryTalk DataMosaix Private Cloud versions <=8.02

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on 2026-07-16

Remediation

Users should upgrade to FactoryTalk DataMosaix Private Cloud version 8.03 or later. Those unable to upgrade should implement Rockwell Automation's security best practices.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing, CVE, Vulnerability, and 1 more.

Read Original Article

Related Coverage

North Korean IT Workers Used Stolen US Identities to Earn $3 Million

Security Affairs

The FBI recently conducted raids on 40 homes in Texas as part of an investigation into a North Korean scheme that involved using stolen identities to create fake IT workers. These impostors targeted around 70 U.S. companies, helping the North Korean regime generate approximately $3 million. The Justice Department disclosed that two U.S. nationals were arrested in connection with this operation, which is part of a broader effort to disrupt North Korea's longstanding tactics of infiltrating American businesses. This incident raises significant concerns about identity theft and the potential for foreign interference in the U.S. economy, highlighting the vulnerabilities that companies face from sophisticated cyber schemes.

Oct 17, 2026

Drupal patches critical RCE flaws, warns exploits may emerge soon

BleepingComputer

Drupal has released patches for two serious vulnerabilities that could enable attackers to execute code remotely on any website running a supported version of its content management system. These vulnerabilities pose a significant risk, as they could allow unauthorized access and control over the affected sites. Users of Drupal are strongly advised to apply the patches immediately to protect their websites from potential exploitation. The urgency is underscored by the possibility that attackers may quickly develop exploits to take advantage of these vulnerabilities. Website administrators should prioritize this update to safeguard their systems and data.

Oct 17, 2026

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

SecurityWeek

A recent investigation revealed that Discover-Tech, an Israeli advertising firm, has been used as a conduit for Candiru's zero-click spyware. This spyware allows attackers to track and fingerprint devices without any user interaction, raising significant privacy concerns. The ads served by Discover-Tech can target specific individuals, making it easier for malicious actors to compromise their devices. This situation is alarming as it highlights the potential misuse of advertising technology for espionage and surveillance purposes, affecting the security of users who interact with these ads. As this information comes to light, it raises questions about how advertising platforms can be exploited and what measures need to be taken to protect users.

Oct 17, 2026

BAE Systems Cyber Incident Takes US Bankruptcy Noticing Center Offline for a Week

Security Affairs

A cyber incident at BAE Systems' US subsidiary has caused significant disruptions, taking the Bankruptcy Noticing Center offline since October 9. This outage has impacted the ability of bankruptcy courts across the United States to send out important notices, affecting both debtors and creditors involved in bankruptcy proceedings. The incident raises concerns about the security measures in place for critical infrastructure systems, especially those that handle sensitive legal and financial information. As the situation continues, it is crucial for BAE Systems to address the underlying issues to prevent future incidents and restore normal operations. The downtime has already delayed crucial notifications, which could have serious implications for ongoing bankruptcy cases.

Oct 17, 2026

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

The Hacker News

Cybersecurity researchers have identified an ongoing campaign where hackers are using compromised Microsoft 365 credentials from ConnectWise Cloud Backup to access the M365 environments of 173 customers. ConnectWise Cloud Backup, previously known as SkyKick, is a service designed for managed service providers to offer cloud-based backup solutions. The attackers are exploiting these stolen credentials to gain unauthorized entry, which poses a significant risk to the affected organizations. This incident not only compromises sensitive data but also raises concerns about the security protocols in place for cloud services used by MSPs. Companies relying on these services should review their security practices and monitor for any unusual activity in their accounts.

Oct 17, 2026

Federal agencies recommend cyber controls, independent testing for frontier AI systems

CyberScoop

Federal agencies have released new cybersecurity guidance aimed at improving the security of AI systems during testing phases, particularly within sandbox environments. While the recommendations are voluntary, they provide a detailed framework for implementing robust cyber controls and conducting independent assessments of frontier AI systems. This guidance is particularly relevant as organizations increasingly experiment with advanced AI technologies, which can introduce unique vulnerabilities if not managed properly. Ensuring these systems are tested securely helps mitigate potential risks before they are deployed in real-world applications. The move reflects a growing recognition of the need for proactive security measures in the rapidly evolving field of artificial intelligence.

Oct 17, 2026