Flowmon ADS CVE-2026-2513
HIGHSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requiring admin click (UI:R); scope changes as script runs in victim's authenticated context; availability impact limited since XSS does not directly crash the service.
Primary rating from Vendor (progress).
CVSS VectorVendor: progress
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.
AnalysisAI
Reflected cross-site scripting in Progress Flowmon Anomaly Detection System (ADS) versions prior to 12.5.5 and 13.0.3 allows an unauthenticated attacker to execute arbitrary JavaScript within an administrator's authenticated browser session by tricking them into clicking a crafted link. Because the payload executes with the full privilege context of the logged-in admin, the attacker can silently trigger administrative actions - such as modifying detection policies, exfiltrating sensitive network telemetry, or altering system configuration - without the victim's awareness. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.05% (14th percentile) indicates low observed exploitation probability.
Technical ContextAI
Flowmon ADS (cpe:2.3:a:progress:flowmon_anomaly_detection_system) is an enterprise network traffic anomaly detection platform developed by Progress Software, deployed to monitor and detect behavioral anomalies across network flows. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that the application fails to sanitize or encode attacker-controlled input before rendering it in the admin web UI - a classic reflected XSS pattern. The vulnerable input vector is the URL itself: a crafted link, when opened in a browser by an authenticated administrator, causes the application to reflect unsanitized content back into the page, where it executes as script within the victim's session context. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms no privileges or special configuration are required on the attacker's side, while UI:A captures the required admin interaction.
RemediationAI
Upgrade Flowmon ADS to version 12.5.5 or later (for 12.x deployments) or to version 13.0.3 or later (for 13.x deployments) per the vendor advisory at https://community.progress.com/s/article/CVE-2026-2513-Progress-Flowmon-ADS. As an interim compensating control while patching, restrict administrator access to the Flowmon ADS web interface to internal trusted networks only, eliminating the opportunity for an external attacker to deliver a malicious link that the admin would click while authenticated. Additionally, enforce Content Security Policy (CSP) headers at a reverse proxy layer if the application itself does not emit them - this can mitigate script execution even if the XSS vector fires. Note that CSP headers applied externally may break other UI functionality if not tuned carefully.
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability
Stored cross-site scripting in Progress Flowmon Anomaly Detection System allows an adjacent-network attacker without cre
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today