VulnSocial

CVE-2026-19471Patch

MEDIUMCVSS 6.9 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-03); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-03: 1Mentions · 2026-09-04: 1Active Exploitation · 2026-09-04: 1Patch / Workaround · 2026-09-03: 1Technical Details · 2026-09-03: 1Technical Details · 2026-09-04: 109-0309-04
Signal classification2 categories
Patch
150.0%
Active Exploitation
150.0%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-09-031
Patch1
2026-09-041
Active Exploitation1
Full discourse2 posts
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploiting stored XSS vulnerabilities (CVE-2026-19471) in Rockwell ArmorStart LT devices to inject malicious scripts and pivot into industrial networks. Combined with DoS capability (CVE-2026-19472), this creates significant operational risk. Runtime segmentation helps contain post-compromise lateral movement in OT environments. #IndustrialSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/rockwell-automation-armorstart-lt-cve-2026-19471-cve-2026-19472

    Post summary

    The post reports attackers actively exploiting stored XSS (CVE-2026-19471) and DoS (CVE-2026-19472) vulnerabilities on Rockwell ArmorStart LT devices, but provides no PoC or patch details.

    0000041
    2.0K followersView on X
  • NewsTongue@NewsTongueX
    Patch

    🔴 Rockwell Automation patches XSS, DoS flaws in ArmorStart LT industrial control software Rockwell Automation ArmorStart LT versions ≤v2.001 contain multiple stored cross-site scripting vulnerabilities (CVE-2026-19471, CVE-2026-19472) and a denial-of-service flaw affecting the embedded web server. Exploitation could inject malicious scripts executed when users access affected pages or crash web server availability. The software is deployed worldwide in critical manufacturing infrastructure. Rockwell released firmware v2.002 with fixes and recommends immediate upgrade. No public exploitation reported to CISA to date.

    Post summary

    Rockwell Automation has released firmware v2.002 that patches stored XSS and a DoS flaw in ArmorStart LT, with no active exploitation reported.

    0000048
    851 followersView on X

Explore more

Back to dashboard