Progress Software Vulnerabilities and Affected Products
Vulnerabilities associated with Flowmon.
Products
Clear product- Telerik UI for ASP.NET AJAX17 vulnerabilities
- LoadMaster15 vulnerabilities
- MOVEit WAF10 vulnerabilities
- Object Scale Connection Manager10 vulnerabilities
- Flowmon7 vulnerabilities
- MOVEit Automation6 vulnerabilities
- ECS Connection Manager5 vulnerabilities
- ECS Connections Manager5 vulnerabilities
- Sitefinity5 vulnerabilities
- Telerik Reporting5 vulnerabilities
- Telerik UI for WPF5 vulnerabilities
- Flowmon ADS4 vulnerabilities
- Telerik Report Server3 vulnerabilities
- Chef Automate2 vulnerabilities
- Hybrid Data Pipeline2 vulnerabilities
- Telerik Document Processing Libraries2 vulnerabilities
- Telerik UI for WinForms2 vulnerabilities
- Chef Inspec1 vulnerability
- Kendo UI for Angular1 vulnerability
- Kendo UI for jQuery1 vulnerability
- KendoReact1 vulnerability
- MOVEit Transfer1 vulnerability
- Multi Tenant1 vulnerability
- Multi Tenant LoadMaster1 vulnerability
- Progress® Telerik® Document Processing Libraries1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-8079HIGH | Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress FlowmonIn Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized access to sensitive data and unintended modifications to system configuration. CWE-863Jul 2, 2026 | CVSS8.7v4.0 | EPSS0.182% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-2737HIGH | Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web applicationA vulnerability exists in Progress Flowmon versions prior to 12.5.8 and 13.0.6, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session. CWE-79Apr 2, 2026 | CVSS8.5v4.0 | EPSS0.196% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-3692HIGH | Unintended command execution during report generation in Progress FlowmonIn Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server. CWE-78Apr 2, 2026 | CVSS8.7v4.0 | EPSS0.42% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-11906MEDIUM | Privilege escalation via writable configuration files in Progress FlowmonA vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization. CWE-732Oct 30, 2025 | CVSS6.7v3.1 | EPSS0.129% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-10240HIGH | Possibility of unintended actions when a user clicks a malicious link in the Progress Flowmon web applicationA vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated session. CWE-79Oct 9, 2025 | CVSS8.8v3.1 | EPSS0.3% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-10239HIGH | Unintended command execution via troubleshooting scripts in Progress FlowmonIn Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes. CWE-78Oct 9, 2025 | CVSS7.2v3.1 | EPSS0.357% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-2389CRITICAL | Flowmon Unauthenticated Command Injection VulnerabilityIn Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands. | CVSS10.0v3.1 | EPSS92.9% | PoCs4 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |