CVE-2025-64180

CRITICAL

Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The fla...

Affects 0 products across 1 vendor.

BCS6.49
CVSS 3.110.0
EPSS0.3%
Percentile24th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-367: CWE-367
CWE-918: Server-Side Request Forgery (SSRF)

Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.

Related Attack Patterns (CAPEC)
CAPEC-27 Leveraging Race Conditions via Symbolic Links
via CWE-367
CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
via CWE-367
CAPEC-664 Server Side Request Forgery
via CWE-918

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A critical vulnerability in Manager Desktop and Server versions 25.11.1.3085 and below allows unauthorized access to internal network resources due to a Time-of-Check Time-of-Use (TOCTOU) condition in the DNS validation mechanism.

BSID: BS-2025-GLOBAL-034074-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-64180?
A critical vulnerability in Manager Desktop and Server versions 25.11.1.3085 and below allows unauthorized access to internal network resources due to a Time-of-Check Time-of-Use (TOCTOU) condition in the DNS validation mechanism.
What is the CVSS score for CVE-2025-64180?
CVE-2025-64180 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 0.3%.
Is CVE-2025-64180 actively exploited?
No confirmed active exploitation of CVE-2025-64180 as of 2026-05-30.
How do I remediate CVE-2025-64180?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-64180?
CVE-2025-64180 affects: Cloud.
Vulnerability Details
CVE IDCVE-2025-64180
BSIDBS-2025-GLOBAL-034074-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2025-11-07
Last Modified2026-04-15
ICS Relevance15%
Weakness (CWE)
CWE-367Server-Side Request Forgery (SSRF)
SourceNVD
Official Description

Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechanism. A Time-of-Check Time-of-Use (TOCTOU) condition that allows attackers to bypass network isolation and access internal services, cloud metadata endpoints, and protected network segments. The Desktop edition requires no authentication; the Server edition requires only standard authentication. This issue is fixed in version 25.11.1.3086.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from a TOCTOU condition in the DNS validation mechanism, which allows attackers to bypass network isolation and access internal services and cloud metadata.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Cloud — —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: August 2026 | Threat Age: 269 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash07867eeced934bc5f87c0909622dffdab8939a7a395b7802e2f19b04d5ab817d095faa8d4fa824406d460deeb1d7c557a9ff2c2f2f6725b02cd5aaac242675ad
Related CVEs affecting Cloud
CVE-2025-54122 10.0 Manager-io/Manager is accounting software. A critical unauthenticated full re... CVE-2025-41243 10.0 Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment p... CVE-2026-0501 9.9 Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Prem... CVE-2025-47282 9.9 Gardener External DNS Management is an environment to manage external DNS ent... CVE-2025-0680 9.8 Affected products contain a vulnerability in the device cloud rpc command han...
View all Cloud CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →