CVE-2026-11917Patch

MEDIUMCVSS 7.2 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1782.html

Weakness type (CWE)

CWE-22

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Peaked 1d ago at 1 mentions (2026-07-23); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Patch

150.0%

Active Exploitation

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-23	1	Patch1
2026-07-24	1	Active Exploitation1

Full discourse2 posts

Aviatrix Threat Research Center@aviatrixtrc91d
Active Exploitation
TRC analysis shows attackers exploiting CVE-2026-11917 in Rockwell Automation ThinManager to write malicious files to system directories, enabling privilege escalation and lateral movement. Runtime segmentation helps contain post-compromise activity in industrial networks. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/icsa-26-204-05-cve-2026-11917
Post summary
Analysis shows that CVE-2026-11917 in Rockwell Automation ThinManager is being actively exploited to write malicious files for privilege escalation and lateral movement, with no patches or mitigations discussed.
0000058
1.9K followersView on X
Windows Forum@windowsforum91d
Patch
⚠️ ThinManager’s high-severity path traversal flaw lets authenticated attackers write beyond its app folder—even into restricted Windows locations. Patch now; factory security isn’t a sandbox. https://windowsforum.com/threads/cve-2026-11917-thinmanager-fixes-path-traversal.440190/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #PathTraversal #OtSecurity #Thinmanager #Cve202611917 https://t.co/xrd9aR8HbY
Post summary
ThinManager’s high‑severity path traversal vulnerability allows authenticated attackers to write files outside the application directory, even into restricted Windows locations; a patch is available and urgently recommended.
0000058
1.3K followersView on X

Explore more

Back to dashboard