FactoryTalk® DataMosaix™ Private Cloud vulnerabilities

4 known vulnerabilities in FactoryTalk® DataMosaix™ Private Cloud from Rockwell Automation. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.4 High severity

  FactoryTalk® DataMosaix™ Private Cloud: Improper Neutralization of Input During Web Page Generation

  CVE-2026-9292Jul 14, 2026Rockwell Automation

  A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges ca

• 8.7 High severity

  FactoryTalk® DataMosaix™ Private Cloud: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-12807Dec 9, 2025Rockwell Automation

  A security issue was discovered in DataMosaix Private Cloud, allowing users with low privilege to perform sensitive database operations through exposed API endpoints.

• 8.6 High severity

  FactoryTalk® DataMosaix™ Private Cloud: Improper Encoding or Escaping of Output

  CVE-2025-11085Nov 11, 2025Rockwell Automation

  A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in the execution of malicious JavaScript, allowing for account takeover, credential theft, or redirection to a malicious website.

• 7.6 High severity

  FactoryTalk® DataMosaix™ Private Cloud: Weak Authentication

  CVE-2025-11084Nov 11, 2025Rockwell Automation

  A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day per