Loading story…
A high-severity server-side request forgery (SSRF) vulnerability (CVE-2025-9065) has been identified in Rockwell Automation ThinManager versions 13.0 through 14.0. Authenticated attackers can exploit this flaw to specify external SMB paths, potentially exposing the ThinServer service account NTLM hash. The issue is remotely exploitable and has been addressed in ThinManager version 14.1.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcerockwellautomation.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities have been identified in the *Studio 5000® Simulation Interface* by Rockwell Automation. The first, tracked as CVE-2025-11697, is a local code execution flaw that allows any Windows user on the affected system to exploit the API using path traversal sequences. This can result in the extraction of files and execution of scripts with Administrator privileges upon system reboot. The second vulnerability, CVE-2025-11696, is a local server-side request forgery (SSRF) issue that enables any Windows user to trigger outbound SMB requests, potentially exposing NTLM hashes to an attacker. Both vulnerabilities were discovered internally by Rockwell Automation during routine security testing and have been disclosed as part of the company’s commitment to transparency. There is currently no evidence of exploitation in the wild, and Rockwell Automation has issued a security advisory (SD1760) confirming that fixes are available. No specific product versions have been listed as affected, but users of Studio 5000® Simulation Interface are advised to review the advisory and apply the recommended updates to mitigate risk.
Jul 12, 2026A critical vulnerability (CVE-2025-7350) has been identified in Rockwell Automation Stratix 5410, 5700, and 8000 industrial Ethernet switches, allowing unauthenticated remote code execution. The flaw, stemming from improper neutralization of special elements (CWE-74), enables attackers to upload and execute malicious configurations through cross-site request forgery. Rockwell Automation has released patches and recommends immediate updates and security best practices.
Jun 29, 2026A cryptographic flaw in FactoryTalk Activation Manager (CVE-2025-7970) allows remote attackers to decrypt traffic, risking data exposure and session hijacking. The vulnerability affects version 5.00 and is rated high severity (CVSS 4.0 score: 8.7). No public exploitation has been reported, and users are urged to update to version 5.02 or later.
Jun 29, 2026