This vulnerability is a stored cross-site scripting (CWE-79) issue in FactoryTalk® DataMosaix™ Private Cloud caused by improper neutralization of user-supplied input within the Workflows configuration. An attacker with authenticated high privileges can inject malicious JavaScript code that is permanently stored on the server. When other users view the affected pages, the malicious scripts execute in their browsers, which may result in account compromise or credential theft. The CVSS 4.0 base score is 8.4, reflecting network attack vector, low attack complexity, no privileges required for attack initiation beyond high privileges for injection, and high impact on confidentiality and integrity. No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation allows an authenticated attacker with high privileges to inject persistent malicious scripts into the application. These scripts execute in the context of other users' browsers when they access the affected pages, potentially enabling account takeover, credential theft, or redirection to malicious websites. This compromises confidentiality and integrity of user sessions and data within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to trusted personnel only and monitor for suspicious activity related to the Workflows configuration. Avoid exposing affected pages to untrusted users. Follow Rockwell Automation advisories for updates on patches or mitigations.