# Path Traversal Bug in Rockwell ThinManager Puts Factory Floors at Risk
## The Threat
Rockwell Automation has patched a high-severity path traversal vulnerability in ThinManager, its thin client and HMI management platform widely deployed across industrial environments. The flaw — tracked as CVE-2026-11917 — lives in the software's API, where insufficient validation of file save operations lets an authenticated attacker write arbitrary files to restricted system directories the application was never meant to touch.
Path traversal vulnerabilities are a classic class of bug, but they carry exceptional weight in industrial control systems. ThinManager is the software that controls how operator terminals connect to PLCs, SCADA systems, and HMI sessions on factory floors, refineries, water treatment plants, and food processing facilities. An attacker who can write files outside the application sandbox could overwrite configuration data, plant persistence mechanisms, or corrupt files critical to terminal availability — all without ever touching a PLC directly.
The attack requires valid credentials, which narrows the threat surface, but doesn't eliminate it. In ICS environments, credential hygiene is notoriously inconsistent — shared service accounts, default passwords, and flat network architectures are common enough that "authenticated" is a meaningful but imperfect barrier.
## Severity and Impact
| Field | Detail |
|---|---|
| CVE | CVE-2026-11917 |
| CWE | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory |
| CVSS v3.1 Score | 8.1 (HIGH) |
| CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
| CVSS v4.0 Score | 7.2 (HIGH) |
| CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Impact | Integrity: HIGH, Availability: HIGH, Confidentiality: None |
The integrity and availability impact scores are both HIGH with no confidentiality impact — consistent with a write-primitive vulnerability. The attacker can't read arbitrary files through this flaw, but they can corrupt or overwrite them, which in an ICS context can mean taking operator stations offline or manipulating how terminals connect to production systems.
## Affected Products
All four active release branches of Rockwell Automation ThinManager are affected:
Deployed across Chemical, Critical Manufacturing, Energy, Food and Agriculture, and Water and Wastewater sectors worldwide.
## Mitigations
Rockwell Automation has released patched versions across all affected branches. Organizations should prioritize upgrading to one of the following corrected releases:
| Affected Range | Fixed Version |
|---|---|
| 13.0.0 – 13.0.6 | 13.0.8 |
| 13.1.0 – 13.1.4 | 13.1.6 |
| 13.2.0 – 13.2.3 | 13.2.5 |
| 14.0.0 – 14.0.1 | 14.0.3 |
For organizations unable to patch immediately:
## References
---
## HackWire Analysis
The interesting thing about CVE-2026-11917 isn't the vulnerability class — path traversal is old, well-understood, and has no excuse appearing in enterprise ICS software in 2026. What's worth paying attention to is the architectural exposure it reveals.
ThinManager occupies a specific and privileged position in Rockwell shop floors: it's the broker between operator terminals and the industrial systems those terminals connect to. Patch it, and you're patching something that touches virtually every human-machine interface in the facility. That's high operational risk during a maintenance window, which means some sites will delay, rationalize a compensating control, and remain exposed longer than the advisory suggests.
The CVSS breakdown tells you something useful here. No confidentiality impact means this isn't a data-theft play — but integrity HIGH and availability HIGH means someone motivated to disrupt operations has a workable path. Write to the wrong directory on a ThinManager server and you could corrupt session configurations, disable terminal groups, or create a position for later persistence that survives a reboot. In a food processing plant or water facility, "availability: HIGH" isn't an abstract score. It maps to production downtime or, in a worst case, a safety event if operators lose visibility at a critical moment.
The breadth of affected release branches — four separate minor version streams, all vulnerable — suggests this issue was present in the API for a substantial window before disclosure. Organizations running ThinManager should assume the vulnerability has been in their environment for months and treat this patch cycle as an opportunity to audit who has authenticated access to ThinManager's API endpoints, not just as a version upgrade.
ICS defenders should add this to the pattern: Rockwell has been on CISA's radar with elevated frequency. When the same vendor appears repeatedly in ICS advisories, it's time to baseline your exposure to that vendor's full product stack, not just respond to the current CVE in isolation.
— HackWire Editorial
## Related Coverage