Latest SUSE Multi-Linux Manager vulnerabilities #
SUSE has disclosed an unauthenticated remote code execution (RCE) vulnerability in certain versions of SUSE Multi-Linux Manager, formerly SUSE Manager. The vulnerability results from missing authentication around critical functions in the aptly named remote commands WebSocket endpoint (/rhn/websocket/minion/remote-commands). Successful exploitation, through omitting the SessionId, would allow an unauthenticated adversary to execute arbitrary commands as root on all managed client Linux servers. This vulnerability has been designated CVE-2025-46811 and has been rated critical with a CVSS score of 9.8.
The following versions are affected
- Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1 versions prior to 0.3.7-150600.3.6.2
- Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1 versions prior to 5.0.14-150600.4.17.1
- Image SLES15-SP4-Manager-Server-4-3-BYOS versions prior to 4.3.33-150400.3.55.2
- Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure versions prior to 4.3.33-150400.3.55.2
- Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 versions prior to 4.3.33-150400.3.55.2
- Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE versions prior to 4.3.33-150400.3.55.2
- SUSE Manager Server Module 4.3 versions prior to 0.3.7-150400.3.39.4
- SUSE Manager Server Module 4.3 versions prior to 4.3.33-150400.3.55.2
What is the impact? #
Successful exploitation of the vulnerability would allow an adversary to potentially execute arbitrary code on the all managed client Linux servers, potentially leading to complete system compromise.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1 upgrade to version 0.3.7-150600.3.6.2 or later
- Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1 upgrade to version 5.0.14-150600.4.17.1 or later
- Image SLES15-SP4-Manager-Server-4-3-BYOS upgrade to version 4.3.33-150400.3.55.2 or later
- Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure upgrade to version 4.3.33-150400.3.55.2 or later
- Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 upgrade to version 4.3.33-150400.3.55.2 or later
- Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE upgrade to version 4.3.33-150400.3.55.2 or later
- SUSE Manager Server Module 4.3 upgrade to version 0.3.7-150400.3.39.4 or later
- SUSE Manager Server Module 4.3 upgrade to version 4.3.33-150400.3.55.2 or later
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially vulnerable assets:
_asset.protocol:http AND protocol:http AND has:html.title AND html.title:="SUSE%Manager - Sign In"
