Rockwell Automation ThinManager

p a href= https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-05.json strong View CSAF /strong /a /p h2 Summary /h2 p strong Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory. /strong /p p The following versions of Rockwell Automation ThinManager are affected: /p ul li ThinManager gt;=13.0.0| lt;13.0.7, gt;=13.1.0| lt;13.1.5, gt;=13.2.0| lt;13.2.4, gt;=14.0.0| lt;14.0.2 /li /ul div class= csaf-table table class= tablesaw tablesaw-stack data-tablesaw-mode= stack data-tablesaw-minimap thead tr th role= columnheader data-tablesaw-priority= persist CVSS /th th role= columnheader Vendor /th th role= columnheader Equipment /th th role= columnheader Vulnerabilities /th /tr /thead tbody tr td v3 8.1 /td td Rockwell Automation /td td Rockwell Automation ThinManager /td td Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') /td /tr /tbody /table /div h3 Background /h3 ul li strong Critical Infrastructure Sectors: /strong Chemical, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater /li li strong Countries/Areas Deployed: /strong Worldwide /li li strong Company Headquarters Location: /strong United States /li /ul hr h2 Vulnerabilities /h2 div class= csaf-accordion p a class= csaf-accordion-toggle-all href= # Expand All + /a /p div class= csaf-accordion-item h3 a class= csaf-accordion-toggle href= # CVE-2026-11917 /a /h3 div class= csaf-accordion-content p A path traversal security issue exists within Rockwell Automation ThinManager software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory. /p p a href= https://www.cve.org/CVERecord?id=CVE-2026-11917 View CVE Details /a /p hr h4 Affected Products /h4 h5 Rockwell Automation ThinManager /h5 div class= ics-vendor-version-status div class= ics-vendor strong Vendor: /strong br Rockwell Automation /div div class= ics-version strong Product Version: /strong br Rockwell Automation ThinManager: gt;=13.0.0| lt;13.0.7, Rockwell Automation ThinManager: gt;=13.1.0| lt;13.1.5, Rockwell Automation ThinManager: gt;=13.2.0| lt;13.2.4, Rockwell Automation ThinManager: gt;=14.0.0| lt;14.0.2 /div div class= ics-status strong Product Status: /strong br known_affected /div /div div class= ics-remediations h6 Remediations /h6 p strong Mitigation /strong br Users using the affected software, should upgrade to one of the corrected versions as follows: /p p strong Vendor fix /strong br ThinManager Versions 13.0.0 - 13.0.7 -- gt; 13.0.8 /p p strong Vendor fix /strong br ThinManager Versions 13.1.0 - 13.1.5 -- gt; 13.1.6 /p p strong Vendor fix /strong br ThinManager Versions 13.2.0 - 13.2.4 -- gt; 13.2.5 /p p strong Vend