Is CVE-2026-9292 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9292 being exploited in the wild.

How severe is CVE-2026-9292?

Informational severity, with a CVSS score of 8.4, published 14 July 2026.

Is there a fix for CVE-2026-9292?

A patch was published on 2026-07-14: Fixed in version 8.03 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9292 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9292?

Check whether you run Rockwell Automation FactoryTalk DataMosaix Private Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9292: Rockwell Automation FactoryTalk DataMosaix Private Cloud XSS in Workflows

CVE-2026-9292 · Severity: info · CVSS 8.4 · Published 2026-07-14

Rockwell Automation's FactoryTalk DataMosaix Private Cloud, an industrial data operations platform, is affected by a security flaw in its workflow configuration. An attacker with high-level access can plant malicious scripts that remain on the server and execute when other users view the affected pages. This could lead to unauthorized access to user accounts, theft of login credentials, or redirection to dangerous websites, potentially disrupting industrial data management.

Vendors: Rockwell Automation.

Quick answers

Is CVE-2026-9292 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9292 being exploited in the wild.
How severe is CVE-2026-9292?: Informational severity, with a CVSS score of 8.4, published 14 July 2026.
Which products and versions are affected?: Rockwell Automation FactoryTalk DataMosaix Private Cloud 8.02 and below.
Is there a fix for CVE-2026-9292?: A patch was published on 2026-07-14: Fixed in version 8.03 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9292 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9292?: Check whether you run Rockwell Automation FactoryTalk DataMosaix Private Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Rockwell Automation FactoryTalk DataMosaix Private Cloud due to improper neutralization of user-supplied input within the Workflows configuration (CWE-79). An authenticated attacker with high privileges can inject malicious JavaScript that is permanently stored on the server. The attack requires a victim to view the compromised configuration page (user interaction). Successful exploitation can result in the execution of arbitrary scripts in the context of the victim's browser session, enabling session hijacking, credential theft, or unauthorized actions. The vulnerability is addressed in version 8.03.

Affected products

Rockwell Automation FactoryTalk DataMosaix Private Cloud 8.02 and below

Timeline

2026-07-14: disclosed
2026-07-14: advisory
2026-07-14: patched: Fixed in version 8.03

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.