ESB-2026.4050 — Vulnetix

ESB-2026.4050 PUBLISHED CVSS 9.800000190734863 CRITICAL

=========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2026.4050 Security update 5.1.3 for Multi-Linux Manager Client Tools 22 April 2026 =========================================================================== AUSCERT Security Bulletin Summary --------------------------------- Product: Multi-Linux Manager Client Tools Publisher: SUSE Operating System: SUSE Resolution: Patch/Upgrade CVE Names: CVE-2026-27606 CVE-2026-33186 CVE-2026-27876 CVE-2026-26958 CVE-2026-1615 CVE-2025-13465 CVE-2026-25547 CVE-2025-3415 CVE-2026-21721 CVE-2025-61140 CVE-2026-21724 CVE-2026-21725 CVE-2026-21722 CVE-2026-27877 CVE-2026-27879 CVE-2026-28375 CVE-2026-21720 Original Bulletin: https://www.suse.com/support/update/announcement/2026/suse-su-20261524-1 Comment: CVSS (Max): 9.8 CVE-2026-1615 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVSS Source: SUSE Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H EPSS (Max): 0.4% (59th) CVE-2026-27606 2026-04-21 - --------------------------BEGIN INCLUDED TEXT-------------------- Security update 5.1.3 for Multi-Linux Manager Client Tools Announcement ID: SUSE-SU-2026:1524-1 Release Date: 2026-04-21T09:26:10Z Rating: critical o bsc#1245302 o bsc#1250367 o bsc#1252548 o bsc#1252964 o bsc#1254154 o bsc#1254619 o bsc#1257329 o bsc#1257337 o bsc#1257349 o bsc#1257442 o bsc#1257447 o bsc#1257660 o bsc#1257841 o bsc#1257897 o bsc#1257941 o bsc#1258015 References: o bsc#1258136 o bsc#1258418 o bsc#1258595 o bsc#1258873 o bsc#1258893 o bsc#1258927 o bsc#1259208 o bsc#1260263 o bsc#1260267 o bsc#1260878 o bsc#1261025 o bsc#1261026 o bsc#1261027 o bsc#1261029 o jsc#MSQA-1048 o jsc#PED-15474 o CVE-2025-13465 o CVE-2025-3415 o CVE-2025-61140 o CVE-2026-1615 o CVE-2026-21720 o CVE-2026-21721 o CVE-2026-21722 o CVE-2026-21724 Cross-References: o CVE-2026-21725 o CVE-2026-25547 o CVE-2026-26958 o CVE-2026-27606 o CVE-2026-27876 o CVE-2026-27877 o CVE-2026-27879 o CVE-2026-28375 o CVE-2026-33186 o CVE-2025-13465 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N /UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N o CVE-2025-13465 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N /S:U/C:N/I:L/A:H o CVE-2025-13465 ( NVD ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/ UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/ MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/ MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X o CVE-2025-13465 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:N/I:L/A:N o CVE-2025-3415 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/ UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N o CVE-2025-3415 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/ S:U/C:L/I:N/A:N o CVE-2025-3415 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/ S:U/C:L/I:N/A:N o CVE-2025-61140 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N /UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N o CVE-2025-61140 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N /S:U/C:H/I:H/A:H o CVE-2025-61140 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:H/I:H/A:H o CVE-2026-1615 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/ UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/ MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/ MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X o CVE-2026-1615 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:H/I:H/A:H o CVE-2026-1615 ( NVD ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/ UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/ MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/ MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X o CVE-2026-1615 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:H/I:H/A:H o CVE-2026-21720 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N /S:U/C:N/I:N/A:H o CVE-2026-21720 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:N/I:N/A:H o CVE-2026-21721 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L /UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N o CVE-2026-21721 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N /S:U/C:H/I:H/A:N o CVE-2026-21721 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/ S:U/C:H/I:H/A:N o CVE-2026-21722 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N /UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N o CVE-2026-21722 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N /S:U/C:L/I:N/A:N o CVE-2026-21722 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:L/I:N/A:N o CVE-2026-21724 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L /UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N o CVE-2026-21724 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N /S:U/C:L/I:L/A:N o CVE-2026-21724 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/ S:U/C:L/I:L/A:N o CVE-2026-21724 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/ S:U/C:N/I:L/A:N o CVE-2026-21725 ( SUSE ): 2.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:L /UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N o CVE-2026-21725 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R /S:U/C:N/I:L/A:L CVSS scores: o CVE-2026-21725 ( NVD ): 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/ S:U/C:N/I:N/A:L o CVE-2026-21725 ( NVD ): 2.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/ S:U/C:N/I:L/A:N o CVE-2026-25547 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N /UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N o CVE-2026-25547 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N /S:U/C:N/I:N/A:H o CVE-2026-25547 ( NVD ): 9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/ UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/ MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/ MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X o CVE-2026-26958 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N /UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N o CVE-2026-26958 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N /S:U/C:N/I:H/A:L o CVE-2026-26958 ( NVD ): 1.7 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/ UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/ MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/ MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X o CVE-2026-27606 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N /UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N o CVE-2026-27606 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R /S:U/C:H/I:H/A:H o CVE-2026-27606 ( NVD ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/ UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/ MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/ MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X o CVE-2026-27606 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:H/I:H/A:H o CVE-2026-27876 ( SUSE ): 8.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H /UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H o CVE-2026-27876 ( SUSE ): 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N /S:C/C:H/I:H/A:H o CVE-2026-27876 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/ S:C/C:H/I:H/A:H o CVE-2026-27877 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N /UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N o CVE-2026-27877 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N /S:U/C:H/I:N/A:N o CVE-2026-27877 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:H/I:N/A:N o CVE-2026-27877 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/ S:U/C:H/I:N/A:N o CVE-2026-27879 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L /UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N o CVE-2026-27879 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N /S:U/C:N/I:N/A:H o CVE-2026-27879 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/ S:U/C:N/I:N/A:H o CVE-2026-28375 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L /UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N o CVE-2026-28375 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N /S:U/C:N/I:N/A:H o CVE-2026-28375 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/ S:U/C:N/I:N/A:H o CVE-2026-33186 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L /UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N o CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N /S:U/C:H/I:H/A:N o CVE-2026-33186 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/ S:U/C:H/I:H/A:N Affected o SUSE Multi-Linux Manager Client Tools for SLE 15 Products: o SUSE Multi-Linux Manager Client Tools for SLE Micro 5 An update that solves 17 vulnerabilities, contains two features and has 13 security fixes can now be installed. Description: This update fixes the following issues: golang-github-lusitaniae-apache_exporter: o Internal changes to fix build issues with no impact for customers golang-github-prometheus-prometheus: o Security issues fixed: o CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893) Bumped rollup to version 4.59.0 o CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841) Bumped brace-expansion to version 5.0.2 o CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442) o CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329) o CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267) Bumped google.golang.org/grpc to version 1.79.3 grafana: o Security issues fixed: o CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136) o CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc# 1257337) o CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349) o CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302) o CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc# 1258595) o CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc# 1258873) o CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc# 1258873) o CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025) o CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026) o CVE-2026-28375: Fixed denial of service via testdata data-source (bsc# 1261029) o CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027) o CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263) o CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878) o Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes: o Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability o Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences o Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced o Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and removed blurred backgrounds from UI overlays to speed up the interface o One-Click Actions: Visualizations now support faster navigation via one-click links and actions o Alerting History: Added version history for alert rules, allowing you to track changes over time o Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup o Cron Support: Annotations now support Cron syntax for more flexible scheduling o Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues when Grafana is hosted on a subpath o Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting o Alerting Limits: Added size limits for expanded notification templates to prevent system strain o RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field o Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated rows or nested queries o Dashboard Reliability: Fixed bugs involving row repeats and "self-referencing" data links Fixed a bug preventing single panels from rendering correctly when dashboard variables are referenced o Alerting Fixes: Patched a critical "panic" (crash) caused by a race condition in alert rules and fixed issues where contact points weren't working correctly o URL Handling: Fixed a bug where "true" values in URL parameters weren't being read correctly prometheus-blackbox_exporter: o Internal changes to fix build issues with no impact for customers spacecmd: o Version 5.1.13-0 o Update translation strings uyuni-tools: o Version 5.1.26-0 o Fixed applying PTF with images from RPMs (bsc#1252548) o Ssl Key file can miss if CA password is blank (bsc#1254154) o mgrpxy ssh tuning should happens before crypto policies (bsc#1254619) o Fixed default value for helm registry (bsc#1258927). o Remove hub register command o Optimize postgres migration disk space usage (bsc#1257447) o Added continuous database backup support (bsc#1250367) o Explicitly start proxy pods after operations (bsc#1258015) o Use static supportconfig name to avoid dynamic search (bsc#1257941) o Do not nest multiple tarball files and instead collect all files into one tarball (bsc#1252964) o Show where final tarball was generated (bsc#1259208) o Set proxy config file permissions (bsc#1257660) o Version 5.1.25-0 o If PTF image doesn't exists, use the current service image (bsc#1258418) Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE Multi-Linux Manager Client Tools for SLE 15 zypper in -t patch SUSE-MultiLinuxManagerTools-SLE-15-2026-1524=1 o SUSE Multi-Linux Manager Client Tools for SLE Micro 5 zypper in -t patch SUSE-MultiLinuxManagerTools-SLE-Micro-5-2026-1524=1 Package List: o SUSE Multi-Linux Manager Client Tools for SLE 15 (aarch64 ppc64le s390x x86_64) mgrctl-5.1.26-150002.3.12.1 grafana-11.6.14+security01-150002.4.14.1 golang-github-prometheus-prometheus-3.5.0-150002.3.8.1 prometheus-blackbox_exporter-0.26.0-150002.3.6.1 firewalld-prometheus-config-0.1-150002.3.8.1 mgrctl-debuginfo-5.1.26-150002.3.12.1 golang-github-lusitaniae-apache_exporter-debuginfo-1.0.10-150002.3.6.1 golang-github-lusitaniae-apache_exporter-1.0.10-150002.3.6.1 grafana-debuginfo-11.6.14+security01-150002.4.14.1 golang-github-prometheus-prometheus-debuginfo-3.5.0-150002.3.8.1 o SUSE Multi-Linux Manager Client Tools for SLE 15 (noarch) mgrctl-bash-completion-5.1.26-150002.3.12.1 mgrctl-zsh-completion-5.1.26-150002.3.12.1 mgrctl-lang-5.1.26-150002.3.12.1 spacecmd-5.1.13-150002.3.9.3 o SUSE Multi-Linux Manager Client Tools for SLE Micro 5 (aarch64 ppc64le s390x x86_64) mgrctl-5.1.26-150002.3.12.1 mgrctl-debuginfo-5.1.26-150002.3.12.1 prometheus-blackbox_exporter-0.26.0-150002.3.6.1 o SUSE Multi-Linux Manager Client Tools for SLE Micro 5 (noarch) mgrctl-bash-completion-5.1.26-150002.3.12.1 mgrctl-zsh-completion-5.1.26-150002.3.12.1 mgrctl-lang-5.1.26-150002.3.12.1 References: o https://www.suse.com/security/cve/CVE-2025-13465.html o https://www.suse.com/security/cve/CVE-2025-3415.html o https://www.suse.com/security/cve/CVE-2025-61140.html o https://www.suse.com/security/cve/CVE-2026-1615.html o https://www.suse.com/security/cve/CVE-2026-21720.html o https://www.suse.com/security/cve/CVE-2026-21721.html o https://www.suse.com/security/cve/CVE-2026-21722.html o https://www.suse.com/security/cve/CVE-2026-21724.html o https://www.suse.com/security/cve/CVE-2026-21725.html o https://www.suse.com/security/cve/CVE-2026-25547.html o https://www.suse.com/security/cve/CVE-2026-26958.html o https://www.suse.com/security/cve/CVE-2026-27606.html o https://www.suse.com/security/cve/CVE-2026-27876.html o https://www.suse.com/security/cve/CVE-2026-27877.html o https://www.suse.com/security/cve/CVE-2026-27879.html o https://www.suse.com/security/cve/CVE-2026-28375.html o https://www.suse.com/security/cve/CVE-2026-33186.html o https://bugzilla.suse.com/show_bug.cgi?id=1245302 o https://bugzilla.suse.com/show_bug.cgi?id=1250367 o https://bugzilla.suse.com/show_bug.cgi?id=1252548 o https://bugzilla.suse.com/show_bug.cgi?id=1252964 o https://bugzilla.suse.com/show_bug.cgi?id=1254154 o https://bugzilla.suse.com/show_bug.cgi?id=1254619 o https://bugzilla.suse.com/show_bug.cgi?id=1257329 o https://bugzilla.suse.com/show_bug.cgi?id=1257337 o https://bugzilla.suse.com/show_bug.cgi?id=1257349 o https://bugzilla.suse.com/show_bug.cgi?id=1257442 o https://bugzilla.suse.com/show_bug.cgi?id=1257447 o https://bugzilla.suse.com/show_bug.cgi?id=1257660 o https://bugzilla.suse.com/show_bug.cgi?id=1257841 o https://bugzilla.suse.com/show_bug.cgi?id=1257897 o https://bugzilla.suse.com/show_bug.cgi?id=1257941 o https://bugzilla.suse.com/show_bug.cgi?id=1258015 o https://bugzilla.suse.com/show_bug.cgi?id=1258136 o https://bugzilla.suse.com/show_bug.cgi?id=1258418 o https://bugzilla.suse.com/show_bug.cgi?id=1258595 o https://bugzilla.suse.com/show_bug.cgi?id=1258873 o https://bugzilla.suse.com/show_bug.cgi?id=1258893 o https://bugzilla.suse.com/show_bug.cgi?id=1258927 o https://bugzilla.suse.com/show_bug.cgi?id=1259208 o https://bugzilla.suse.com/show_bug.cgi?id=1260263 o https://bugzilla.suse.com/show_bug.cgi?id=1260267 o https://bugzilla.suse.com/show_bug.cgi?id=1260878 o https://bugzilla.suse.com/show_bug.cgi?id=1261025 o https://bugzilla.suse.com/show_bug.cgi?id=1261026 o https://bugzilla.suse.com/show_bug.cgi?id=1261027 o https://bugzilla.suse.com/show_bug.cgi?id=1261029 o https://jira.suse.com/browse/MSQA-1048 o https://jira.suse.com/browse/PED-15474 - --------------------------END INCLUDED TEXT---------------------- You have received this e-mail bulletin as a result of your organisation's registration with AUSCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AUSCERT's members. As AUSCERT did not write the document quoted above, AUSCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AUSCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://portal.auscert.org.au/bulletins/ =========================================================================== AUSCERT The University of Queensland, Brisbane QLD 4072 Australia e: auscert@auscert.org.au t: +61 (0)7 3365 4417 Allies in Cyber Security ===========================================================================

Risk Scores

CVSS v3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
SUSE	Multi-Linux Manager Client Tools

Timeline

Apr 22, 2026 CVE Published

References

Open in Interactive Console →