Flowmon CVE-2026-3692

Q: What is the CVSS score of CVE-2026-3692?

CVE-2026-3692 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18224 HIGH

OS Command Injection (CWE-78)

2026-04-02 ProgressSoftware

GHSA-r5rp-h6qf-2vgf

Command Injection Flowmon

8.7

CVSS 4.0 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ProgressSoftware) · only source for this CVE.

CVSS VectorVendor: ProgressSoftware

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 02, 2026 - 13:45 euvd

EUVD-2026-18224

Analysis Generated

Apr 02, 2026 - 13:45 vuln.today

CVE Published

Apr 02, 2026 - 13:27 nvd

HIGH 8.7

DescriptionCVE.org

In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.

AnalysisAI

Progress Flowmon versions prior to 12.5.8 allow authenticated low-privileged users to execute arbitrary commands on the server by crafting malicious requests during the report generation process. The vulnerability stems from improper input validation in the report generation functionality, enabling command injection attacks. While no CVSS score or public exploit code has been disclosed at time of analysis, the direct path to remote code execution via an authenticated user represents a significant risk to Flowmon deployments.

Technical ContextAI

The vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a classic command injection flaw. Progress Flowmon's report generation process fails to properly sanitize or validate user-supplied input before passing it to underlying system commands. An authenticated user with low privilege levels can exploit this by injecting shell metacharacters or command separators into report parameters, causing the application server to execute unintended operating system commands with the privileges of the Flowmon service account. This affects the report generation engine across all Flowmon versions prior to 12.5.8, as specified in the CPE range cpe:2.3:a:progress_software:flowmon:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade Progress Flowmon to version 12.5.8 or later. This version includes fixes to properly sanitize and validate user input during the report generation process, eliminating the command injection vector. Organizations unable to immediately upgrade should restrict low-privileged user access to report generation functionality where possible, implement network-level access controls to limit report generation API endpoints, and monitor for suspicious report generation requests that include shell metacharacters or unusual command-like syntax. Refer to the Progress Software advisory at https://community.progress.com/s/article/CVE-2026-3692-Progress-Flowmon for comprehensive patching guidance and any interim workarounds.