Topic starter
11/07/2026 8:49 pm
TL;DR: CISA’s advisory on CVE-2025-9065 describes an authenticated SSRF flaw in Rockwell Automation ThinManager that can expose a high-privilege service account’s NTLM credentials, creating pass-the-hash, relay, and lateral-movement risk across OT and IT-connected environments, according to ColorTokens. The issue shows how service-account trust assumptions and network segmentation can fail together when OT systems expose credentials over outbound connections.
Editorial analysis by NHI Mgmt Group, based on content published by ColorTokens: “Addressing CISA Advisory on Rockwell Automation ThinManager SSRF Vulnerability (CVE-2025-9065)”.
Key questions
Q: What breaks when an OT application can authenticate outbound on behalf of a service account?
A: The control that breaks is the assumption that trusted OT systems only consume connections rather than create identity-bearing ones.
Q: Why does an exposed NTLM hash create broader risk than a single account compromise?
A: An NTLM hash can function as reusable authentication material, so the attacker may not need the password in clear text.
Q: How can security teams tell whether an industrial service account has too much reach?
A: A service account has too much reach when it can authenticate across management, operator, and enterprise segments without a clear operational need.
Practitioner guidance
- Harden outbound authentication from OT applications Restrict which industrial systems can initiate SMB and other authenticated outbound connections, especially from management and session-brokering components.
- Rotate service-account credentials after exposure Replace the affected service account password after upgrading so any captured NTLM material is invalidated.
- Reduce privilege on industrial service accounts Audit whether the ThinManager service account or similar OT identities truly needs broad access across management, operator, and enterprise segments, then remove any unnecessary reach.
Bottom line: The ThinManager flaw shows how an authenticated SSRF issue can turn an OT application into a credential exposure path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:16 pm
Outbound authentication from a trusted OT server is a broken trust assumption: The ThinManager issue shows that segmented networks still fail when the server itself is allowed to initiate identity-bearing connections. That assumption was designed for controlled service traffic, not attacker-chosen SMB destinations. The implication is that OT trust boundaries must be evaluated at the point where systems originate authentication, not only where they receive traffic.
A question worth separating out:
Q: What should OT and IAM teams do when an SSRF flaw exposes service-account credentials?
A: They should contain the vulnerable system, rotate the affected service-account secret after remediation, and review where that identity is accepted. The key question is whether the account can still be used outside its intended OT boundary before the environment is re-opened.
👉 Read our full editorial: CVE-2025-9065 exposes NTLM service accounts in ThinManager