CISA flags Rockwell Automation ThinManager flaw affecting industrial users
CISA has issued an advisory for a Rockwell Automation ThinManager vulnerability, identified as CVE-2026-11917, and said vendor updates are available for affected versions.
CISA said Rockwell Automation ThinManager contains a path traversal flaw that could let an authenticated attacker write arbitrary files outside the intended directory, and it urged users to apply vendor fixes.
CISA published an advisory on Rockwell Automation ThinManager after identifying a path traversal vulnerability tracked as CVE-2026-11917. The agency said successful exploitation could allow an authenticated attacker to write arbitrary files to restricted system directories outside the application’s intended directory.
ThinManager is used in industrial settings, including Chemical, Critical Manufacturing, Energy, Food and Agriculture, and Water and Wastewater sectors, according to the advisory. CISA marked the product status as known affected and said deployment is worldwide.
The advisory describes the flaw as improper limitation of file save operations within the API. CISA gave the issue a CVSS v3.1 base score of 8.1, labeled high, and a CVSS v4.0 base score of 7.2, also labeled high.
According to CISA, the affected versions are ThinManager 13.0.0 through 13.0.6, 13.1.0 through 13.1.4, 13.2.0 through 13.2.3, and 14.0.0 through 14.0.1. The agency said users should upgrade to ThinManager 13.0.8, 13.1.6, 13.2.5, or 14.0.3, depending on the branch they run.
If upgrading is not possible, CISA pointed users to Rockwell Automation’s security best practices and the company’s security advisories page. The agency also repeated standard industrial control system guidance, including minimizing network exposure, keeping control system networks and remote devices behind firewalls, and isolating them from business networks.
CISA said the company headquarters is in the United States and credited Rockwell Automation with reporting the vulnerability. The advisory also said no known public exploitation specifically targeting this issue has been reported to CISA at this time.
For remote access, CISA said organizations should use VPNs when required, while keeping them updated because VPNs can also have vulnerabilities. It also said suspected malicious activity should be reported to CISA for tracking and correlation.
The advisory was initially released on 2026-07-14 and republished on 2026-07-23.
What happens next
Operators using affected ThinManager versions will need to move to the fixed releases listed by CISA or follow Rockwell Automation’s security guidance if upgrades are not immediately possible.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()