CISA advisories cover four Rockwell Automation vulnerabilities across 1756-ENBT, ControlFLASH, and ArmorStart LT

The ControlFLASH installer grants write permissions to the Windows 'Everyone' group on the product's installation directory, leaving that directory writable by any local account. An attacker who already has low-privileged access to the machine can plant or modify files in the directory, and when a user launches ControlFLASH the attacker's code runs at that logged-in user's permission level (user interaction is required). This gives the attacker arbitrary code execution of their choosing on the target machine, though within the privileges of the launching user rather than full system-level escalation. Any Windows host where ControlFLASH was installed with these default permissions is affected, typically engineering or maintenance workstations in Rockwell Automation/Allen-Bradley environments. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS predicts only a 0.1% chance of exploitation in the next 30 days.

Do: Check Rockwell Automation's security advisory for the affected ControlFLASH versions and fixed release, and update the installer/software when available; as an interim measure, audit the ACLs on the ControlFLASH installation directory (e.g., with icacls) and remove write access for the Everyone group, restricting write permissions to administrators. Identify workstations where ControlFLASH is installed, limit local logon to trusted accounts, and monitor the installation directory for unexpected or modified files.

CVE-2026-19471 describes multiple stored cross-site scripting (XSS) flaws in Rockwell Automation's ArmorStart LT, caused by user-supplied input that is not properly sanitized before being stored on the device. An attacker can inject malicious scripts into stored fields, and those scripts execute in the browser of any user who later views the affected page in the device's interface. Per the CVSS 4.0 vector, the attack is carried out over the network and requires no privileges or user interaction beyond viewing the stored content, but the rated impact is limited (low impact to confidentiality, integrity, and availability), meaning an attacker could typically run scripts in other users' sessions within the product's interface rather than compromise the broader system. Affected users are organizations running ArmorStart LT distributed motor-control units whose management or web interfaces are accessed by operators and engineers. As of now there is no known public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

Do: Monitor the Rockwell Automation security advisory ([email protected]) for the affected version ranges and fixed firmware, and apply the vendor's update when released. In the meantime, restrict access to ArmorStart LT management interfaces to trusted personnel, limit or avoid browser access to the device UI from untrusted endpoints, and ensure the units are segmented from untrusted networks. Because impact is limited to script execution in users' browsers, standard web-session hygiene and network segmentation substantially reduce risk.

Rockwell Automation's ArmorStart LT distributed motor controller contains a denial-of-service flaw in its embedded web server, classified as CWE-770 (allocation of resources without limits). A remote, unauthenticated attacker can trigger it by sending a single specially crafted HTTP PUT request to the device's web interface, per the CVSS 4.0 vector (network attack vector, no privileges or user interaction required). The result is a crash or hang of the web server and loss of the device's web management interface; the CVSS scoring indicates no confidentiality or integrity impact and no impact on downstream systems. Organizations running ArmorStart LT motor controllers, typically in plant-floor OT networks, are affected, especially where the embedded web server is reachable from untrusted networks. No public proof-of-concept or known exploitation exists, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

Do: Check the Rockwell Automation security advisory for affected and fixed firmware versions (not specified in the available data) and plan a firmware update when releases are identified. Until then, restrict HTTP access to ArmorStart LT web servers to trusted management networks using firewall rules, ACLs, or network segmentation, and avoid exposing the embedded web server directly to the internet. Monitor devices for unexplained web interface outages, which would indicate possible exploitation attempts.