Progress Flowmon ADS
CVE-2026-2514
HIGH
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent access required to inject traffic; no attacker privileges needed; user interaction required to trigger rendering; scope changes as XSS runs in admin browser; no direct availability impact from XSS itself.
Primary rating from Vendor (progress).
CVSS VectorVendor: progress
Lifecycle Timeline
4DescriptionCVE.org
In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.
AnalysisAI
Stored cross-site scripting in Progress Flowmon Anomaly Detection System allows an adjacent-network attacker without credentials to embed JavaScript payloads in crafted network traffic that, when ingested by Flowmon ADS and viewed by an authenticated administrator, executes arbitrary script in the admin's browser context. Affected versions are all 12.x releases prior to 12.5.5 and all 13.x releases prior to 13.0.3. Successful exploitation can yield session hijacking, unauthorized administrative actions within the Flowmon platform, or exfiltration of sensitive network intelligence visible to the logged-in user. No public exploit code or CISA KEV listing is identified at time of analysis.
Technical ContextAI
Progress Flowmon ADS is an enterprise network anomaly detection platform that collects and analyzes network flows from monitored ports and presents findings through a browser-based web interface. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): data fields derived from raw network traffic - such as hostnames, HTTP headers, or flow metadata - are not adequately sanitized before being rendered in the Flowmon web UI. An attacker exploits this by embedding JavaScript within crafted network packets or flow payloads traversing a monitored segment; Flowmon ADS processes and stores these records, and the injected script executes when an authenticated user opens a page displaying the affected data. Affected CPE: cpe:2.3:a:progress:flowmon_anomaly_detection_system covering versions below 12.5.5 and 13.0.3.
RemediationAI
Upgrade to Progress Flowmon ADS version 12.5.5 or 13.0.3 per the vendor advisory at https://community.progress.com/s/article/CVE-2026-2514-Progress-Flowmon-ADS - this is the only confirmed fix. If immediate patching is not feasible, implement network ACLs on Flowmon monitoring ports to restrict which network segments can submit traffic to the collector, directly reducing the attacker's ability to inject malicious packets; this is the highest-value compensating control. Additionally, limit Flowmon web interface access to a minimal set of trusted analysts on hardened workstations and enforce multi-factor authentication on all Flowmon accounts to reduce the blast radius of a successful session hijack. Reducing the frequency and scope of dashboard review sessions also limits the window during which injected payloads could execute. Note that none of these compensating controls eliminate the vulnerability - patching remains mandatory.
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability
Reflected cross-site scripting in Progress Flowmon Anomaly Detection System (ADS) versions prior to 12.5.5 and 13.0.3 al
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today