CVE-2023-27856: Rockwell ThinManager ThinServer path traversal in message type 8

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote file disclosure with a high CVSS score and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is present.

What it is

ThinManager ThinServer contains a path traversal flaw (CWE-22) triggered when it processes a message of type 8. An unauthenticated remote attacker can use it to download arbitrary files from the disk drive where ThinServer.exe is installed. Because the service is reachable over the network with no credentials required, exposed ThinServer instances are directly at risk of file disclosure.

Impact

An attacker gains read access to arbitrary files on the ThinServer installation drive, which can expose configuration data, credentials or other sensitive files. There is no integrity or availability impact per the CVSS vector; the loss is confidentiality only.

Attack surface

Reachable over the network via a crafted message of type 8 sent to the ThinServer service; the CVSS vector shows AV:N/PR:N/UI:N, so no authentication and no user interaction are needed. The record does not specify which port or protocol carries the message.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.77225 probability, 0.9953 percentile), indicating a strong likelihood of attempted exploitation, but the record contains no public exploit or in-the-wild confirmation.

What to do

• Apply the Rockwell Automation fix referenced in advisory a_id/1138640; treat patching as the first action.
• Restrict network access to ThinServer so only trusted management hosts can reach it, using firewall rules or segmentation.
• Do not expose ThinServer directly to untrusted networks or the internet.
• Monitor the vendor advisory for updated affected-version and workaround guidance, since the record does not list affected versions.
• Review file system permissions on the ThinServer drive to limit what a successful traversal could read.

Detection

• Alert on unexpected message type 8 traffic to ThinServer hosts and baseline normal message-type usage.
• Monitor ThinServer process file reads for paths containing traversal sequences (../) or access to files outside expected directories.
• Watch for anomalous outbound transfers or repeated file-read activity from ThinServer hosts.
• Correlate ThinServer access logs with source IPs that are not known management stations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.