CVE-2025-3617: Local Privilege Escalation in ThinManager®

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-15 · updated 2026-06-17
Weakness: CWE-276

Description

A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder causing the Access Control Entry of the directory to inherit permissions from the parent directory. If exploited, a threat actor could inherit elevated privileges.

Affected products

Rockwell Automation ThinManager ThinServer: from 14.0.0 before 14.0.2 — fixed in 14.0.2

How to fix

Upgrade to a fixed version: Rockwell Automation ThinManager ThinServer 14.0.2. Check the vendor advisory for mitigations.

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1727.html

Get alerted when CVE-2025-3617 or the next vulnerability affects your stack