Flowmon CVE-2026-2737

Requires three specific prerequisites: (1) attacker possesses valid low-privileged credentials to Progress Flowmon (PR:L in CVSS vector) or ability to deliver payload to authenticated users, (2) target administrator must actively click the malicious link while maintaining an authenticated session to the Flowmon web interface (UI:A in CVSS vector), and (3) the vulnerable Flowmon version must be network-accessible to the attacker for payload delivery (AV:N in CVSS vector). Exploitation is LIMITED by mandatory user interaction - attacks cannot execute without administrator participation, making this unsuitable for automated mass exploitation. The requirement for existing authentication (PR:L) or successful social engineering of authenticated admins creates additional friction compared to unauthenticated remote vulnerabilities. Network accessibility requirements can be reduced through administrative controls restricting Flowmon interface exposure to internal networks only, though this depends on deployment architecture rather than default configuration.

Real-world exploitation risk is moderate despite the high CVSS 8.5 score, with multiple limiting factors tempering urgency. The CVSS vector reveals critical constraints: PR:L requires authenticated low-privileged access (attacker needs valid credentials or must compromise an existing user), and UI:A mandates user interaction (administrator must click the malicious link). EPSS probability of 0.05% (15th percentile) indicates minimal observed exploitation in the wild, consistent with SSVC designation of 'Exploitation: none'. The SSVC 'Automatable: no' assessment aligns with UI:A requirement - attacks cannot be mass-deployed without social engineering each target individually. However, SSVC rates 'Technical Impact: total', reflecting that successful exploitation grants attackers full control over administrator sessions (session hijacking, privilege escalation, configuration manipulation). The vulnerability presents genuine risk in targeted attacks against Flowmon administrators, particularly through phishing or watering hole attacks, but lacks characteristics of widespread opportunistic exploitation. The disparity between high CVSS (8.5) and low EPSS (0.05%) suggests this is a conditional-risk vulnerability requiring specific attacker investment rather than a mass-exploitation scenario. Organizations should prioritize patching based on their Flowmon deployment exposure, administrator security awareness maturity, and whether Flowmon interfaces are accessible from untrusted networks.

An attacker with low-privileged Flowmon credentials crafts a malicious URL containing JavaScript payload and delivers it to a Flowmon administrator via email, instant message, or embeds it in a compromised website the administrator frequents. When the administrator clicks the link while authenticated to the Flowmon web interface, the unescaped script executes in their browser session with administrator privileges, enabling the attacker to steal session tokens, modify network monitoring configurations, exfiltrate sensitive traffic analysis data, or create persistent backdoor accounts. The CVSS AC:L indicates minimal technical barriers once the malicious link is delivered. No public proof-of-concept code has been identified, but the straightforward nature of XSS exploitation makes attack replication feasible for skilled attackers without specialized tooling.