{"id":"CVE-2026-19471","state":"PUBLISHED","title":"Rockwell Automation ArmorStart® LT Stored Cross-site scripting","description":"Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page.","publishedAt":"2026-09-01T12:49:04.606Z","updatedAt":"2026-09-01T15:40:53.080Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"Rockwell"},"assigner":"Rockwell","products":["Rockwell Automation ArmorStart® LT"],"affected":[{"vendor":"Rockwell Automation","product":"ArmorStart® LT","defaultStatus":"unaffected","versions":[{"version":"v2.001 and below","status":"affected"}]}],"references":["https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1797.html"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19471.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19471","state":"PUBLISHED","datePublished":"2026-09-01T12:49:04.606Z","dateUpdated":"2026-09-01T15:40:53.080Z","assignerShortName":"Rockwell","assignerOrgId":"b73dd486-f505-4403-b634-40b078b177f0","dateReserved":"2026-08-10T14:37:12.656Z"},"containers":{"cna":{"title":"Rockwell Automation ArmorStart® LT Stored Cross-site scripting","descriptions":[{"lang":"en","value":"Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page."}],"affected":[{"vendor":"Rockwell Automation","product":"ArmorStart® LT","defaultStatus":"unaffected","versions":[{"version":"v2.001 and below","status":"affected"}]}],"references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1797.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"Rockwell","orgId":"b73dd486-f505-4403-b634-40b078b177f0","dateUpdated":"2026-09-01T13:08:06.649Z"},"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rockwell_automation:armorstart_lt:v2.001_and_below:*:*:*:*:*:*:*"}]}]}],"solutions":[{"lang":"en","value":"Upgrade to version \n v2.002 https://compatibility.rockwellautomation.com/Pages/Downloads.aspx  or later.","supportingMedia":[{"type":"text/html","base64":false,"value":"Upgrade to version&nbsp;\n<a href=\"https://compatibility.rockwellautomation.com/Pages/Downloads.aspx?c=118&amp;vid=66792&amp;pbt=1&amp;pbp=290E\">v2.002</a>&nbsp;or later."}]}],"source":{"advisory":"SD1797","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-01T15:40:46.426395Z","id":"CVE-2026-19471","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-01T15:40:53.080Z"}}]}}}