Cyber Posture

CVE-2025-46070

Critical

Published: 12 January 2026

Published
12 January 2026
Modified
21 January 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0037 59.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely remediation of critical flaws like CVE-2025-46070 in BotManager.exe to prevent remote arbitrary code execution.

RA-5 Vulnerability Monitoring and Scanning good match
preventdetect

Mandates vulnerability scanning to identify and prioritize remediation of the specific improper certificate validation flaw (CWE-295) enabling RCE.

SC-7 Boundary Protection partial match
prevent

Enforces boundary protection to monitor and control network communications, mitigating remote exploitation of the network-accessible BotManager.exe vulnerability.

Security SummaryAI

CVE-2025-46070 is a critical vulnerability affecting Automai BotManager version 25.2.0, specifically the BotManager.exe component. Published on 2026-01-12, it stems from CWE-295 and enables a remote attacker to execute arbitrary code. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its severe potential impact.

A remote attacker can exploit this vulnerability over the network with low attack complexity, no required privileges, and no user interaction. Successful exploitation grants the attacker the ability to execute arbitrary code on the affected system, compromising confidentiality, integrity, and availability to a high degree.

Mitigation details and advisories are available in the referenced sources, including the ZeroBreach-GmbH Gist at https://gist.github.com/ZeroBreach-GmbH/776dd7e927d9b2f8ef10807abe124f8e and the vendor site at https://www.automai.com/.

Details

CWE(s)
CWE-295

Affected Products

automai
botmanager
25.2.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CVE-2025-46070 enables remote arbitrary code execution over the network with no privileges or user interaction required, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References