Executive Summary
CVE-2026-9292 is a stored cross-site scripting flaw in Rockwell Automation FactoryTalk DataMosaix Private Cloud versions 8.02 and earlier, where improper neutralization of input during web page generation lets an authenticated attacker plant malicious scripts that execute in the browser context of any operator who later views the affected page. The physical criticality is indirect but real: DataMosaix aggregates production and process data across manufacturing operations, so a compromised session at this layer becomes a foothold for lateral movement toward the systems that actually move product.
Technical Exposure Breakdown
The vulnerable component is the web application front end of DataMosaix Private Cloud. The defect is classic input neutralization failure. User-supplied input is persisted server side and then rendered back into a web page without adequate encoding or sanitization, which means an attacker who can write to a stored field is able to embed script that runs when the page loads for another user.
The attack vector requires authentication. This is a stored XSS, not a reflected one, so the payload does not depend on tricking a victim into clicking a crafted link. Once the malicious content is written, it fires against every subsequent viewer of the affected view. The rated severity sits at CVSS v3 6.1, which reflects the authentication requirement and the user interaction needed for the payload to land against a target.
The important condition for OT teams is the trust boundary. DataMosaix is a data mosaic layer that pulls from FactoryTalk and adjacent historian and MES sources. An authenticated attacker is often not a stranger at the perimeter. It is a contractor account, a shared engineering login, a compromised vendor credential, or an insider. In flat OT networks where a single set of credentials touches multiple applications, the value of stealing an authenticated session at this tier is disproportionate to the modest CVSS number. Script execution in an administrator browser session can harvest session tokens, issue authenticated requests on the victim behalf, or scrape process data that maps out the plant.
OT Impact and Compliance Risk
Nothing in this flaw directly commands a PLC or opens a valve. The physical risk is downstream. If a DataMosaix operator or administrator session is hijacked, the attacker gains a vantage point on aggregated production data and potentially the credentials or pivot paths to move deeper into the FactoryTalk environment. In a Critical Manufacturing setting that means reconnaissance quality intelligence on line configuration, throughput, and control system topology.
For IEC 62443 aligned programs this is a zone and conduit problem. DataMosaix typically lives at Purdue Level 3 operations management, and a script running in a privileged browser session violates the assumption that Level 3 is a controlled boundary between the enterprise and the cell. Under 62443-3-3, requirements around input validation (SR 3.5) and session integrity (SR 3.8) are directly implicated. For entities inside NERC CIP scope, a DataMosaix instance classified as a Cyber Asset associated with a BES environment brings CIP-007 patch management and CIP-005 electronic security perimeter obligations into play. Manufacturing operators without a bulk electric nexus still carry the audit exposure through their internal 62443 governance.
Compensating Controls
Do not treat vendor patching as the whole answer, and do not run an active vulnerability scan against a live DataMosaix node without a maintenance window. Aggressive probing of the web tier can destabilize the service that operators depend on for production visibility.
- Constrain the authenticated population. This flaw needs a valid session. Remove shared logins, enforce per-user accounts with role separation, and audit who actually holds write access to fields that render into shared views.
- Virtual patch at the reverse proxy. Front DataMosaix with a web application firewall or reverse proxy that enforces output encoding and strips script tags on both submission and rendering paths. Set a strict Content-Security-Policy header that disallows inline script execution, which neutralizes the majority of stored XSS payloads even when the underlying field remains vulnerable.
- Suricata concept. Deploy a rule on the conduit into the DataMosaix zone that inspects HTTP POST bodies for script markers such as
<script,onerror=, andjavascript:in form fields, alerting on injection attempts and giving your SOC the write event before the render event. Pair this with a rule watching for anomalous outbound requests from the DataMosaix host that would indicate token exfiltration. - Session hardening. Enforce short session lifetimes, HttpOnly and Secure cookie flags, and network segmentation so that a stolen session cannot be replayed from outside the operations zone.
BreachSpider Intel
BreachSpider tracks Rockwell FactoryTalk exposure and stored injection classes across the OT stack so operators can prioritize compensating controls before a low-CVSS flaw becomes a pivot point.