Flowmon CVE-2026-3692

Requires authenticated low-privileged user account on Progress Flowmon versions prior to 12.5.8. Attacker must craft malicious request during report generation process. No victim interaction needed.

Despite the absence of a formal CVSS score and EPSS probability metric, this vulnerability carries substantial real-world risk. The attack requires authentication, which limits the initial attack surface to users with legitimate Flowmon access; however, low privilege requirements mean that compromised standard user accounts, contractor access, or insider threats can trigger exploitation. The direct path to command execution with server-level privileges (CWE-78) indicates high technical impact. No CISA KEV confirmation or public exploit code has been identified at time of analysis, suggesting this may not yet be actively exploited in the wild, but the straightforward nature of command injection attacks and the availability of vendor guidance indicates that exploitation likelihood is moderate to high once the attack method becomes widely known. Organizations should prioritize patching this vulnerability, particularly for internet-facing or multi-tenant Flowmon instances.

An authenticated low-privileged user with access to Flowmon's reporting interface crafts a specially formed report generation request that includes command injection payloads in report parameters, such as injection points in report name, filter criteria, or export format fields. When the Flowmon server processes this request and generates the report, it passes the unsanitized user input to an underlying OS command (such as a report export utility or data processing script), causing arbitrary commands to execute with the privileges of the Flowmon service account. An attacker could leverage this to exfiltrate network traffic data, modify monitoring configurations, or establish persistence on the monitoring infrastructure. No public exploit code has been identified at time of analysis.