CVE-2025-9065 exposes NTLM service accounts in ThinManager

At a glance

What this is: This article covers CVE-2025-9065 in ThinManager, where authenticated SSRF can expose a high-privilege NTLM service account and widen OT lateral-movement risk.

Why it matters: OT and IAM teams need to see how service-account credentials, outbound trust paths, and segmentation controls can collapse together when an industrial system is forced to authenticate externally.

Context

CVE-2025-9065 is an authenticated server-side request forgery flaw in Rockwell Automation ThinManager that can coerce the application into making outbound connections on behalf of a high-privilege service account. In practical terms, the issue turns a managed OT component into an unintended credential disclosure path.

That matters because service accounts in industrial environments often sit behind broad trust assumptions, especially when thin-client management, remote terminals, and session brokering are treated as infrastructure rather than identity-bearing systems. Once NTLM material is exposed, the problem is no longer just application security. It becomes an access governance problem across OT and IT-connected estates.

The article’s starting position is typical for OT security: a single exposed service account can become a cross-segment movement vector when network controls and authentication design are both permissive.

Key questions

Q: What breaks when an OT application can authenticate outbound on behalf of a service account?

A: The control that breaks is the assumption that trusted OT systems only consume connections rather than create identity-bearing ones. Once the server can initiate outbound authentication, the application itself becomes a credential relay path. That can expose reusable NTLM material and turn a segmented environment into a lateral-movement surface.

Q: Why does an exposed NTLM hash create broader risk than a single account compromise?

A: An NTLM hash can function as reusable authentication material, so the attacker may not need the password in clear text. If the compromised account has cross-segment privileges, the hash can unlock additional systems and make one exposure behave like multiple compromises.

Q: How can security teams tell whether an industrial service account has too much reach?

A: A service account has too much reach when it can authenticate across management, operator, and enterprise segments without a clear operational need. Warning signs include the same identity appearing in unrelated zones, repeated outbound authentication, and credentials that remain valid long after the original system action completes.

Q: What should OT and IAM teams do when an SSRF flaw exposes service-account credentials?

A: They should contain the vulnerable system, rotate the affected service-account secret after remediation, and review where that identity is accepted. The key question is whether the account can still be used outside its intended OT boundary before the environment is re-opened.

Technical breakdown

How SSRF turns an OT application into a credential relay

Server-side request forgery lets an attacker influence a server’s outbound requests. In this case, the ThinServer component is induced to reach a controlled SMB endpoint, so the application itself becomes the network actor that initiates authentication. That matters because firewall rules and segmentation often allow internal servers to make outbound calls that no external attacker could make directly. The security failure is not only input validation. It is the assumption that outbound authentication from a trusted OT system is safe by default. Once the server makes the request, its identity material can be exposed without the attacker needing direct network reach into the protected segment.

Practical implication: review which OT applications are allowed to originate outbound authentication and restrict those paths at the network layer.

Why NTLM service accounts create a lateral-movement problem

NTLM hashes are not passwords in plain text, but they are still usable authentication material. If an attacker captures the hash for a high-privilege service account, that material may support pass-the-hash or relay attacks without cracking the password first. In OT environments, service accounts often have long-lived, operationally embedded access that spans management servers, operator workstations, and related infrastructure. That converts a single credential exposure into a broader trust-chain problem. The core issue is not merely that an account exists. It is that the account’s authentication artifact can be reused outside the original system boundary and may carry more privilege than the original requester should ever have had.

Practical implication: classify service-account hashes as reusable credentials and reduce the blast radius of any account that can authenticate across segments.

How IT-OT connectivity changes the blast radius of an SSRF flaw

IT-OT connectivity expands the impact of an application flaw because the exposed credential can bridge operational and enterprise environments. A compromised OT server that can authenticate outward may be able to pivot into adjacent systems, especially where segmentation is incomplete or where trust relationships were built for convenience rather than containment. ThinManager is used for remote terminals and session brokering, so its failure mode sits close to access pathways rather than isolated process control. That proximity makes the vulnerability more than a local software bug. It is a boundary failure between industrial availability requirements and identity trust assumptions that were never meant to survive attacker-controlled requests.

Practical implication: treat OT application outbound paths as segmentation choke points and verify they cannot be used as identity bridges.

Threat narrative

Attacker objective: The attacker aims to reuse a high-privilege service account credential to move laterally across connected industrial and enterprise systems.

1. Entry occurs when an authenticated attacker submits a crafted request that triggers the SSRF condition in ThinManager.
2. Credential access follows when ThinServer is coerced into opening an outbound SMB connection that exposes the service account’s NTLM material.
3. Escalation occurs if the captured hash is reused for pass-the-hash or relay activity against other systems that trust the same account.
4. Impact is lateral movement across OT and IT-connected environments, with potential access to additional industrial or enterprise systems.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Outbound authentication from a trusted OT server is a broken trust assumption: The ThinManager issue shows that segmented networks still fail when the server itself is allowed to initiate identity-bearing connections. That assumption was designed for controlled service traffic, not attacker-chosen SMB destinations. The implication is that OT trust boundaries must be evaluated at the point where systems originate authentication, not only where they receive traffic.

NTLM service accounts create identity blast radius beyond the application boundary: A high-privilege service account in an industrial management layer is not just an application dependency. It is a reusable identity with operational reach, and its hash can become a portable access artifact. That exposes the gap between application ownership and identity governance. Practitioners need to treat service-account reachability as part of the security model, not a hidden implementation detail.

ThinManager exemplifies the OT microsegmentation problem, not just a vulnerability problem: The flaw becomes dangerous because OT systems often must communicate across management, operator, and enterprise zones. When identity material is exposed through an allowed outbound path, segmentation alone does not stop reuse of the credential elsewhere. This is where service-account governance, path restriction, and credential containment converge.

ThinManager SSRF shows why compensating controls matter when patching lags: In industrial environments, remediation windows are often constrained by uptime and vendor qualification cycles. That makes the control question broader than versioning. The real issue is whether the environment can contain a privileged service account even while the vulnerable application remains in place. The implication is that OT identity controls must be designed for delayed patch reality.

Credential exposure in OT is a governance issue, not only a detection issue: Once an NTLM hash is exposed, detection may come too late because the reuse path can look like legitimate authentication. The stronger lesson is that the exposed credential should never have been reusable across so many trust zones in the first place. Practitioners should narrow cross-segment identity exposure before relying on alerts to catch misuse.

What this signals

Outbound trust paths are now part of identity governance in OT: ThinManager illustrates that identity risk does not stop at login or directory design. When industrial applications initiate authenticated connections, the governance question shifts to whether those paths can be abused to reveal credentials or cross segments without operator intent. If the answer is yes, the programme has a boundary problem, not just a patch problem.

Service-account blast radius is the real OT control variable: The practical measure is no longer simply whether a service account exists. It is whether the account’s reusable credentials can travel beyond the system that issued them and whether segmentation still holds when the application itself becomes the sender. That is the point where OT security, PAM discipline, and network containment must be managed together.

For practitioners

• Harden outbound authentication from OT applications Restrict which industrial systems can initiate SMB and other authenticated outbound connections, especially from management and session-brokering components. Treat every allowed outbound identity exchange as a potential credential exposure path.
• Rotate service-account credentials after exposure Replace the affected service account password after upgrading so any captured NTLM material is invalidated. Reset downstream trust relationships that may have cached or reused that account.
• Reduce privilege on industrial service accounts Audit whether the ThinManager service account or similar OT identities truly needs broad access across management, operator, and enterprise segments, then remove any unnecessary reach.
• Use containment controls where patching is delayed Apply network isolation and identity containment for vulnerable OT systems that cannot be upgraded immediately, so an SSRF-triggered outbound request cannot become a cross-segment trust bridge.
• Monitor for NTLM reuse across segments Look for authentication patterns that indicate pass-the-hash, relay activity, or unexpected service-account use outside its normal OT scope.

Key takeaways

• The ThinManager flaw shows how an authenticated SSRF issue can turn an OT application into a credential exposure path.
• The risk is not limited to one server because reusable NTLM material can support pass-the-hash or relay activity across connected systems.
• Containment depends on limiting outbound authentication paths, reducing service-account reach, and rotating exposed credentials after remediation.

Key terms

• Server-Side Request Forgery: An attack pattern where a vulnerable server is tricked into making requests on the attacker’s behalf. In application exploitation, SSRF can be used to reach internal resources, fetch malicious payloads, or amplify a flaw into full code execution.
• NTLM Hash: An NTLM hash is a cryptographic representation of a password used in Windows authentication flows. It can sometimes be reused to authenticate without knowing the password itself, which is why exposure of a privileged hash is treated as a live credential issue rather than a simple disclosure.
• Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
• OT Segmentation: The practice of separating industrial systems into controlled zones so traffic and access can be restricted by operational need. In effective programmes, segmentation depends on trustworthy asset identity, accurate communication mapping, and enforced rules that reflect how the environment really behaves.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.