Stored XSS on an embedded web server needs two conditions, and both are ordinary on a plant floor. Someone who can reach the device over HTTP writes input the interface stores without sanitizing it [3]. Then another user opens that page and the script runs in their browser [3][5]. The second condition is why this belongs on a patch cycle and not a call-out: the payload sits until an engineer or a maintenance tech looks at the starter.
The other entry is a single request class. A crafted HTTP PUT to the embedded web server is handled badly enough to cost the web server its availability, filed under CWE-770, allocation of resources without limits or throttling [4]. The blast radius is narrow: CISA scopes the outcome to loss of web server availability [5][15]. That covers the starter's configuration and diagnostic interface, separate from the starter itself. It is a nuisance during commissioning and a real problem during a fault chase, which is exactly when someone will be trying to load the page.
The advisory hands out two CVE IDs, CVE-2026-19471 and CVE-2026-19472, against everything at or below v2.001 [2], then describes the defects in two blocks, one CWE-79 and one CWE-770, without saying which ID belongs to which [11]. The published text also carries no CVSS metrics [10]. So the ranking work falls to the asset owner, and a change ticket that cites only a CVE number will not tell the reviewer whether the reviewer is approving a script fix or an outage fix. Cite the advisory and the firmware version instead.
Both blocks name the same remediation, firmware version v2.002 [6], so a single flash resolves both CVE IDs at once [14]. In the interim, the reach reduction is CISA's standing list: keep control system devices off the internet, behind firewalls, isolated from business networks, with remote access through a maintained VPN [13].
Rockwell reported these to CISA itself [8], and the advisory records no exploitation and no proof of concept [12]. For a product line installed worldwide in critical manufacturing [9], that ordering matters: the fix exists before anyone has published the input string that triggers it. The head start lasts only as long as v2.001 stays on the wall.
