CVE-2026-11917

HIGH

Rockwell Automation FactoryTalk ThinManager - Path Traversal

Title source: rule

Description

A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.

References (1)

Core 1

Core References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1782.html

Scores

CVSS v4 7.2

EPSS 0.0032

EPSS Percentile 24.9%

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (1)

Rockwell Automation/FactoryTalk ThinManager 13.0.0 – 13.0.7, 13.1.0 – 13.1.5, 13.2.0 – 13.2.4, 14.0.0 – 14.0.2

Published Jul 14, 2026

Tracked Since Jul 14, 2026