Topic starter
11/07/2026 8:49 pm
TL;DR: An authenticated SSRF flaw in Rockwell Automation ThinManager can expose a high-privilege service account's NTLM credentials, according to ColorTokens. OT environments then face pass-the-hash, relay, and lateral-movement risk if that identity reaches beyond its intended boundary.
Editorial analysis by NHI Mgmt Group, based on content published by ColorTokens: “Addressing CISA Advisory on Rockwell Automation ThinManager SSRF Vulnerability (CVE-2025-9065)”.
Key questions
Q: Why does an exposed NTLM hash create broader risk than a single account compromise?
A: An NTLM hash can function as reusable authentication material, so the attacker may not need the password in clear text.
Q: How can security teams tell whether an industrial service account has too much reach?
A: A service account has too much reach when it can authenticate across management, operator, and enterprise segments without a clear operational need.
Q: What breaks when an OT application can authenticate outbound on behalf of a service account?
A: The control that breaks is the assumption that trusted OT systems only consume connections rather than create identity-bearing ones.
Practitioner guidance
- Harden outbound authentication from OT applications Restrict which industrial systems can initiate SMB and other authenticated outbound connections, especially from management and session-brokering components.
- Rotate service-account credentials after exposure Replace the affected service account password after upgrading so any captured NTLM material is invalidated.
- Reduce privilege on industrial service accounts Audit whether the ThinManager service account or similar OT identities truly needs broad access across management, operator, and enterprise segments, then remove any unnecessary reach.
Bottom line: The ThinManager flaw shows how an authenticated SSRF issue can turn an OT application into a credential exposure path.
Glossary terms: Server-Side Request Forgery, NTLM Hash, Service Account, OT Segmentation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
11/07/2026 9:16 pm
Outbound authentication from a trusted OT server is a broken trust assumption: The ThinManager issue shows that segmented networks still fail when the server itself is allowed to initiate identity-bearing connections. That assumption was designed for controlled service traffic, not attacker-chosen SMB destinations. The implication is that OT trust boundaries must be evaluated at the point where systems originate authentication, not only where they receive traffic.
A question worth separating out:
Q: What should OT and IAM teams do when an SSRF flaw exposes service-account credentials?
A: They should contain the vulnerable system, rotate the affected service-account secret after remediation, and review where that identity is accepted. The key question is whether the account can still be used outside its intended OT boundary before the environment is re-opened.
👉 Read our full editorial: CVE-2025-9065 exposes NTLM service accounts in ThinManager