CVE-2026-19471: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Rockwell Automation ArmorStart® LT

This vulnerability involves multiple stored XSS issues in ArmorStart® LT, where user input is not properly sanitized before being stored and later rendered in web pages. This allows attackers to inject malicious scripts that execute in the context of other users viewing the affected pages. The CVSS 4.0 score is 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

An attacker can inject persistent malicious scripts that execute in the browsers of users accessing the affected pages, potentially leading to session hijacking, unauthorized actions, or data theft within the context of the vulnerable application. The impact is limited by the low to limited confidentiality, integrity, and availability impacts as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time.