CVE-2025-46070

Critical

Published: 12 January 2026

Published

12 January 2026

Modified

21 January 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0048 65.4th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-46070 is a critical-severity Improper Certificate Validation (CWE-295) vulnerability in Automai Botmanager. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires timely remediation of critical flaws like CVE-2025-46070 in BotManager.exe to prevent remote arbitrary code execution.

RA-5 Vulnerability Monitoring and Scanning good match

preventdetect

Mandates vulnerability scanning to identify and prioritize remediation of the specific improper certificate validation flaw (CWE-295) enabling RCE.

SC-7 Boundary Protection partial match

prevent

Enforces boundary protection to monitor and control network communications, mitigating remote exploitation of the network-accessible BotManager.exe vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2025-46070 enables remote arbitrary code execution over the network with no privileges or user interaction required, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component

Deeper analysisAI

CVE-2025-46070 is a critical vulnerability affecting Automai BotManager version 25.2.0, specifically the BotManager.exe component. Published on 2026-01-12, it stems from CWE-295 and enables a remote attacker to execute arbitrary code. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its severe potential impact.

A remote attacker can exploit this vulnerability over the network with low attack complexity, no required privileges, and no user interaction. Successful exploitation grants the attacker the ability to execute arbitrary code on the affected system, compromising confidentiality, integrity, and availability to a high degree.

Mitigation details and advisories are available in the referenced sources, including the ZeroBreach-GmbH Gist at https://gist.github.com/ZeroBreach-GmbH/776dd7e927d9b2f8ef10807abe124f8e and the vendor site at https://www.automai.com/.