CVE-2025-46070
Published: 12 January 2026
Summary
CVE-2025-46070 is a critical-severity Improper Certificate Validation (CWE-295) vulnerability in Automai Botmanager. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-46070 is a critical vulnerability affecting Automai BotManager version 25.2.0, specifically the BotManager.exe component. Published on 2026-01-12, it stems from CWE-295 and enables a remote attacker to execute arbitrary code. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its severe potential impact.
A remote attacker can exploit this vulnerability over the network with low attack complexity, no required privileges, and no user interaction. Successful exploitation grants the attacker the ability to execute arbitrary code on the affected system, compromising confidentiality, integrity, and availability to a high degree.
Mitigation details and advisories are available in the referenced sources, including the ZeroBreach-GmbH Gist at https://gist.github.com/ZeroBreach-GmbH/776dd7e927d9b2f8ef10807abe124f8e and the vendor site at https://www.automai.com/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1924
Vulnerability details
An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-46070 enables remote arbitrary code execution over the network with no privileges or user interaction required, directly facilitating T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of critical flaws like CVE-2025-46070 in BotManager.exe to prevent remote arbitrary code execution.
Mandates vulnerability scanning to identify and prioritize remediation of the specific improper certificate validation flaw (CWE-295) enabling RCE.
Enforces boundary protection to monitor and control network communications, mitigating remote exploitation of the network-accessible BotManager.exe vulnerability.