Which versions of Factorytalk Thinmanager are affected by CVE-2026-11917?

Rockwell Automation FactoryTalk ThinManager contains an authenticated path traversal vulnerability enabling arbitrary file writes to system locations on OT management servers, with risk of code…

How to fix or mitigate CVE-2026-11917?

Within 24 hours, audit all FactoryTalk ThinManager installations and immediately restrict API access to essential administrative accounts; disable external connectivity and internet-facing ThinManager services. Within 7 days, implement network segmentation isolating ThinManager servers from production OT networks, enable comprehensive API logging capturing all file operations, and configure automated alerts for path traversal patterns and attempts to write files outside standard application directories. Within 30 days, contact Rockwell Automation to obtain patch timeline clarity, evaluate alternative OT management platforms, develop targeted detection signatures for exploitation attempts, and conduct tabletop exercises testing incident response procedures.

Factorytalk Thinmanager CVE-2026-11917

Q: What is the CVSS score of CVE-2026-11917?

CVE-2026-11917 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43704 HIGH

Path Traversal (CWE-22)

2026-07-14 Rockwell

GHSA-h5wg-mm35-jjgv

Path Traversal Rockwell Factorytalk Thinmanager Rockwell Automation

7.2

CVSS 4.0 · Vendor: Rockwell

Severity by source

Vendor (Rockwell) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Rockwell) · only source for this CVE.

CVSS VectorVendor: Rockwell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 16:01 vuln.today

CVE Published

Jul 14, 2026 - 15:07 cve.org

HIGH 7.2

DescriptionCVE.org

A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.

AnalysisAI

Arbitrary file write in Rockwell Automation FactoryTalk ThinManager allows an authenticated attacker to abuse a path traversal flaw in the software's API, saving files outside the application's intended directory into restricted system locations. Because CWE-22 file-write primitives on a Windows-based OT management server commonly enable code execution or service disruption, this carries an integrity and availability impact (CVSS 4.0 base 7.2). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.