FactoryTalk DataMosaix EUVD-2026-43702

Exploitation requires an authenticated account with high privileges (PR:H) over the Workflows configuration feature of FactoryTalk DataMosaix Private Cloud - this is the exact feature where unsanitized input is stored. It is a stored/persistent XSS, so the attacker injects once, but the malicious script only executes when a second, separate user navigates to the affected Workflows page (UI:P / passive user interaction is required). Limiting factors: the high-privilege prerequisite excludes anonymous or low-privilege attackers, and payload execution is gated on a victim actually loading the compromised page, so there is no fully automated, unauthenticated remote trigger against a default configuration.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) is internally consistent with the description: network-reachable, low complexity, but requiring high privileges (PR:H) and passive user interaction (UI:P) from a victim who opens the page. The score of 8.4 is driven by high confidentiality and integrity impact within the vulnerable system, with no availability or cross-system scope impact. The PR:H requirement is the dominant mitigating factor - an attacker must already hold a high-privilege account, which substantially narrows the realistic threat to malicious insiders, compromised admin credentials, or a multi-stage attack. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so exploitation probability cannot be quantified; the absence of these signals combined with PR:H suggests this is a meaningful but not urgent, internet-worm-style priority. Because DataMosaix is an OT-adjacent platform, the trust placed in privileged operators makes stored XSS a credible pivot for lateral privilege escalation despite the PR:H gate.

A malicious insider or an attacker who has obtained high-privilege credentials logs into FactoryTalk DataMosaix Private Cloud and saves a crafted JavaScript payload into a Workflows configuration field. When another operator or administrator later opens that Workflows page, the stored script runs in their session, letting the attacker steal their session token or credentials or redirect them to a malicious site. No public exploit code was identified, and success depends on a second victim user viewing the affected page (UI:P).