Threat Investigation
Request a demo

CVE-2025-46811

Critical

Description

A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.

SeverityCritical
CVSS9.8
Exploit probability—
ProductContainer suse/manager/5.0/x86_64/server:5.0.5.7.30.1
PublishedJul 30, 2025
First seenJul 30, 2025
Weakness typeCWE-862Missing authorization

How to fix

Update
  • SUSE Container suse/manager/5.0/x86_64/server:5.0.5.7.30.15.0.27-150600.3.33.1 or later
  • SUSE Image SLES15-SP4-Manager-Server-4-3-BYOS4.3.87-150400.3.110.2 or later
  • SUSE Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure4.3.87-150400.3.110.2 or later
  • SUSE Image SLES15-SP4-Manager-Server-4-3-BYOS-EC24.3.87-150400.3.110.2 or later
  • SUSE Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE4.3.87-150400.3.110.2 or later
  • SUSE SUSE Manager Server Module 4.34.3.87-150400.3.110.2 or later

Affected products

ProductAffected versionsFixed in
SUSE Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1? ≤ v < 5.0.27-150600.3.33.15.0.27-150600.3.33.1
SUSE Image SLES15-SP4-Manager-Server-4-3-BYOS? ≤ v < 4.3.87-150400.3.110.24.3.87-150400.3.110.2
SUSE Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure? ≤ v < 4.3.87-150400.3.110.24.3.87-150400.3.110.2
SUSE Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2? ≤ v < 4.3.87-150400.3.110.24.3.87-150400.3.110.2
SUSE Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE? ≤ v < 4.3.87-150400.3.110.24.3.87-150400.3.110.2
SUSE SUSE Manager Server Module 4.3? ≤ v < 4.3.87-150400.3.110.24.3.87-150400.3.110.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.