VulnSocial

CVE-2026-19472Patch

MEDIUMCVSS 8.7 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-770

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-03); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-03: 1Mentions · 2026-09-04: 1Active Exploitation · 2026-09-04: 1Patch / Workaround · 2026-09-03: 1Technical Details · 2026-09-03: 1Technical Details · 2026-09-04: 109-0309-04
Signal classification2 categories
Patch
150.0%
Active Exploitation
150.0%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-09-031
Patch1
2026-09-041
Active Exploitation1
Full discourse2 posts
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploiting stored XSS vulnerabilities (CVE-2026-19471) in Rockwell ArmorStart LT devices to inject malicious scripts and pivot into industrial networks. Combined with DoS capability (CVE-2026-19472), this creates significant operational risk. Runtime segmentation helps contain post-compromise lateral movement in OT environments. #IndustrialSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/rockwell-automation-armorstart-lt-cve-2026-19471-cve-2026-19472

    Post summary

    Report confirms attackers are actively exploiting stored XSS in Rockwell ArmorStart LT devices, coupled with a DoS flaw, posing significant operational risk to industrial networks.

    0000041
    2.0K followersView on X
  • NewsTongue@NewsTongueX
    Patch

    🔴 Rockwell Automation patches XSS, DoS flaws in ArmorStart LT industrial control software Rockwell Automation ArmorStart LT versions ≤v2.001 contain multiple stored cross-site scripting vulnerabilities (CVE-2026-19471, CVE-2026-19472) and a denial-of-service flaw affecting the embedded web server. Exploitation could inject malicious scripts executed when users access affected pages or crash web server availability. The software is deployed worldwide in critical manufacturing infrastructure. Rockwell released firmware v2.002 with fixes and recommends immediate upgrade. No public exploitation reported to CISA to date.

    Post summary

    Rockwell Automation has issued firmware v2.002 to fix stored XSS and DoS weaknesses in ArmorStart LT; no active exploitation is reported.

    0000048
    851 followersView on X

Explore more

Back to dashboard