CISA republished Rockwell’s advisory on September 3, two days after Rockwell issued advisory SD1797 on September 1. Both say there are no known reports of public exploitation. That is reassuring only in the narrow sense that CISA has not received such reports; it does not change the exposure created when an industrial controller’s management web server is reachable from a less-trusted network segment.
Two flaws, different operational consequences
CVE-2026-19471 covers multiple stored cross-site scripting, or stored XSS, weaknesses in ArmorStart LT’s web interface. Rockwell says user-supplied data can be stored without proper sanitization, allowing injected script to run later when another user opens the affected page. In practice, the attack is aimed at the people who administer the controller—not at the motor logic directly.
That distinction matters in a plant where a browser is used to inspect status, configure equipment, or troubleshoot a line. A successful stored-XSS attack can place malicious code in a page that appears to come from a trusted on-machine controller. Depending on the browser session and the functions exposed by the interface, that could enable a misleading management view, unauthorized actions performed in the administrator’s session, or credential and session-data theft.
Rockwell assigns CVE-2026-19471 a 7.3 CVSS 3.1 score and a 6.9 CVSS 4.0 score. The lower CVSS 4.0 rating reflects limited direct impact to confidentiality, integrity, and availability of the vulnerable product, but it should not be read as a reason to ignore the vulnerability. Stored XSS is especially unwelcome in operational environments because it breaks a basic assumption administrators make during an incident: that the local controller interface is a trustworthy place to inspect what is happening.
CVE-2026-19472 is operationally more direct. Rockwell says a crafted HTTP PUT request to the embedded web server can trigger improper resource handling and cause loss of web-server availability. The vendor rates it 7.5 under CVSS 3.1 and 8.7 under CVSS 4.0, both high severity. CISA’s vulnerability-enrichment record classifies the issue as automatable, meaning it is suited to repeatable targeting once an attacker can reach the service.
The published impact is loss of the web server, not a documented takeover of controller logic or a documented loss of motor control. That boundary should guide response planning. Teams should not invent a safety consequence Rockwell has not claimed, but a controller that loses its management interface during a production issue can still increase downtime, delay diagnosis, and complicate recovery.
The CISA summary compresses a meaningful severity difference
CISA’s advisory page presents a 7.5 vendor CVSS figure for the ArmorStart LT disclosure. That matches the denial-of-service flaw’s CVSS 3.1 rating, but it does not describe the full picture: the stored-XSS issue is scored 7.3 in CVSS 3.1, while the denial-of-service issue rises to 8.7 in Rockwell’s CVSS 4.0 assessment.
For vulnerability-management programs that ingest an ICS advisory as a single ticket, that shorthand can conceal why the update needs more than one owner. The XSS flaw belongs in the discussion between OT administrators, Windows workstation administrators, and security teams responsible for browser and identity controls. The HTTP PUT denial-of-service issue belongs in the operational availability discussion: which controllers expose web management, which ones sit on shared industrial segments, and what happens if a remote interface becomes unavailable during production.
The two CVEs are therefore connected by the firmware update, but they are not interchangeable risks. A single generic “high severity” label can lead teams to patch without checking whether administrative workstations can still reach the controller interface from ordinary business networks—a configuration that would leave too much exposure even after this specific update is installed.
Version 2.002 is the fix for this advisory—verify the hardware family
Rockwell’s SD1797 identifies version 2.002 as the corrected firmware for both new CVEs and lists the affected catalog numbers as 290E, 291E, and 294E. The catalog designation is important. ArmorStart LT has appeared in other 2026 Rockwell advisories under different catalog-number families, and similarly named firmware revisions are not a safe substitute for a device-level inventory.
In January, Rockwell disclosed nine separate ArmorStart LT denial-of-service vulnerabilities in advisory SD1768. The National Vulnerability Database records at least some of those January issues as affecting versions through 2.002, while Rockwell’s January advisory listed no corrected firmware and no workaround. Its affected catalog-number listings refer to 290D, 291D, and 294D equipment rather than the 290E, 291E, and 294E models named in SD1797.
The practical conclusion is not that version 2.002 fails to patch the September vulnerabilities. Rockwell explicitly says it does patch CVE-2026-19471 and CVE-2026-19472 on the models named in SD1797. The conclusion is that administrators must not use a firmware number alone as proof that every ArmorStart LT security issue is addressed. Confirm the exact Bulletin catalog number, hardware generation, installed firmware, and the advisories applicable to that asset before closing a remediation record.
This is a familiar OT inventory problem. Enterprise endpoint tooling may identify a browser, a Windows engineering station, or a switch reliably while reducing an industrial controller to an IP address and generic vendor string. For this case, the remediation evidence should preserve the controller’s catalog number, serial or asset identifier, current firmware, target firmware, network zone, and planned rollback or recovery process.
Keep the embedded web server out of ordinary reach
CISA’s mitigation guidance is blunt: minimize exposure of control-system devices, do not expose them to the internet, place control and remote-device networks behind firewalls, and isolate them from business networks. Those are not boilerplate recommendations for these two CVEs. Both flaws are in the ArmorStart LT web server, and CVE-2026-19472 specifically depends on a crafted HTTP PUT request reaching that service.
A sensible short-term containment plan for units that cannot immediately be updated is to restrict management access to designated engineering workstations and management jump hosts. Firewall policy should allow only the protocols and source systems genuinely needed for operations; a broad rule allowing user VLANs or general corporate subnets to browse directly to on-machine controllers turns an embedded service into an unnecessarily accessible target.
Teams should also examine their remote-access path, including VPN-connected engineering laptops. A controller may be correctly isolated from the public internet yet remain reachable by a compromised workstation that receives broad access after connecting remotely. The relevant question is not whether the controller has a public address. It is whether an untrusted device can route to the controller’s HTTP or HTTPS management service.
Rockwell offers no separate workaround for SD1797 beyond its security best practices. Network filtering can reduce exposure, particularly to the denial-of-service request path, but it does not remove the stored-XSS defect from an unpatched web interface. Nor should a firewall rule be treated as a permanent substitute for corrected firmware when operators routinely access the page from authorized systems.
Update planning should account for production recovery
ArmorStart LT controllers are on-machine motor-control devices, so firmware maintenance needs the same operational discipline as a PLC or drive change. Before upgrading, validate the selected package against the specific 290E, 291E, or 294E asset; document the existing configuration; confirm the maintenance window; and make sure operators know what behavior to expect during the update and restart.
The update should be tested first on a representative nonproduction unit where possible. Plant teams should verify that EtherNet/IP communications, controller status visibility, any web-based configuration functions, and the motor-control workflow all return to the expected condition afterward. A successful firmware transfer is not enough evidence that a production asset is ready to be marked remediated.
Windows administrators have a role here as well. Engineering workstations and jump servers used to administer these controllers should be treated as privileged OT assets: patched browsers, restricted local administrative access, endpoint monitoring that does not disrupt vendor tooling, and tightly controlled remote sessions. The stored-XSS issue targets the browser-mediated management plane, where a compromised Windows session can become the bridge between ordinary IT access and an industrial device.
Rockwell’s version 2.002 release closes the two September web-server vulnerabilities for the affected E-series ArmorStart LT models. The next operational milestone is an asset-by-asset firmware verification that distinguishes those units from older ArmorStart LT catalog families—and leaves no controller web interface reachable from networks that have no business managing it.