# CVE-2026-19472: Rockwell Automation ArmorStart LT denial of service in HTTP PUT handler

Source: https://junglewise.ai/threats/cve-2026-19472-rockwell-automation-armorstart-lt-denial-of-service-in-http-put  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19472 · Severity: info · CVSS 7.5 · Published 2026-09-01

ArmorStart LT is a motor controller device used in industrial automation systems. A denial-of-service vulnerability in the embedded web server can be triggered by sending a specially crafted HTTP PUT request, causing the web interface to become unavailable and disrupting access to the device's configuration and monitoring capabilities.

Vendors: [Rockwell Automation](https://junglewise.ai/threats/vendors/rockwell-automation).

## Quick answers

**Is CVE-2026-19472 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19472 being exploited in the wild.

**How severe is CVE-2026-19472?** Informational severity, with a CVSS score of 7.5, published 1 September 2026.

**Which products and versions are affected?** Rockwell Automation ArmorStart LT v2.001 and below.

**Is there a fix for CVE-2026-19472?** A patch was published on 2026-09-01: Corrected in firmware version 2.002 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19472 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-19472?** Check whether you run Rockwell Automation ArmorStart LT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a resource exhaustion vulnerability (CWE-770) in the HTTP PUT request handler of the embedded web server in ArmorStart LT firmware versions 2.001 and below. The vulnerability stems from improper handling of crafted HTTP PUT requests, which can be exploited remotely without authentication to cause unbounded resource allocation and crash the web server. An attacker with network access to the device can trigger a denial of service by sending a specially crafted PUT request, resulting in loss of web server availability. The issue is fixed in firmware version 2.002.

## Affected products

- Rockwell Automation ArmorStart LT v2.001 and below

## Timeline

- 2026-09-01: disclosed
- 2026-09-01: patched: Corrected in firmware version 2.002

## References

- [https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1797.html](https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1797.html)

## Related threats

- [Rockwell Automation ArmorStart LT stored cross-site scripting](https://junglewise.ai/threats/cve-2026-19471-rockwell-automation-armorstart-lt-stored-cross-site-scripting)