What is the CVSS score of CVE-2025-43904?

CVE-2025-43904 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Suse are affected by CVE-2025-43904?

Organizations using SchedMD Slurm should be aware of moderate risk from CVE-2025-43904, a incorrect authorization vulnerability rated CVSS 4.2.. A patch is available.

How to fix or mitigate CVE-2025-43904?

Within 30 days: Identify affected systems running SchedMD Slurm and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Suse CVE-2025-43904

MEDIUM

Incorrect Authorization (CWE-863)

2026-01-16 cve@mitre.org

Authentication Bypass Suse

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 06, 2026 - 08:30 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 16, 2026 - 18:16 nvd

MEDIUM 4.2

DescriptionCVE.org

In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator.

AnalysisAI

In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator. [CVSS 4.2 MEDIUM]

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects In SchedMD Slurm. In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator.

Affected ProductsAI

Product: In SchedMD Slurm. Versions: up to 24.11.5.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Same weakness CWE-863 – Incorrect Authorization

View all

CVE-2025-54253 CRITICAL POC

10.0

CVE-2025-24200 MEDIUM

6.1

CVE-2025-21480 HIGH

8.6

CVE-2025-21479 HIGH

8.6

CVE-2017-4915 HIGH POC

7.8

CVE-2024-6782 CRITICAL POC

9.8

CVE-2024-38856 CRITICAL POC

9.8

CVE-2023-22518 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Module for HPC 12 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed

CVE-2025-43904 vulnerability details – vuln.today

Back

Suse CVE-2025-43904

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Same weakness CWE-863 – Incorrect Authorization

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code