Which versions of FlexNet Manager Suite are affected by CVE-2026-4026?

Flexera FlexNet Manager Suite 2025 R1 contains a privilege escalation vulnerability (CVSS 8.7) that allows any employee with read-only account access to elevate themselves to full Administrator.

How to fix or mitigate CVE-2026-4026?

Within 24 hours: Audit all Flexera FlexNet Manager Suite 2025 R1 deployments in your environment; identify and document all read-only account holders; enable comprehensive audit logging for account privilege and permission changes. Within 7 days: Implement interim controls-network segmentation restricting read-only account access, functional restrictions per CWE-284 mitigation guidance; escalate to Flexera Support for interim patches or technical workarounds. Within 30 days: Apply vendor-released patch once available; if patch timeline extends beyond 30 days, evaluate accelerated upgrade schedule or alternative license management solutions.

FlexNet Manager Suite CVE-2026-4026

Q: What is the CVSS score of CVE-2026-4026?

CVE-2026-4026 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38010 HIGH

Improper Access Control (CWE-284)

2026-06-19 flexera

GHSA-rjpc-35cg-xm5c

Authentication Bypass Flexnet Manager Suite Flexera

8.7

CVSS 4.0 · Vendor: flexera

Severity by source

Vendor (flexera) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web app, no user interaction, but requires an authenticated read-only account (PR:L); full compromise of FNMS app yields C/I/A:H with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (flexera).

CVSS VectorVendor: flexera

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:15 vuln.today

DescriptionCVE.org

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 that could allow an authenticated user with read-only access to account settings to escalate their privileges to Administrator level.

AnalysisAI

Privilege escalation in Flexera FlexNet Manager Suite 2025 R1 allows an authenticated user holding only read-only access to account settings to elevate themselves to full Administrator. The flaw is a server-side access-control failure (CWE-284) reachable over the network with low privileges and no user interaction, scoring CVSS 4.0 8.7. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

FlexNet Manager Suite is Flexera's enterprise software asset management (SAM) platform used to track license entitlements, consumption and compliance across on-prem and cloud estates. The CPE cpe:2.3:a:flexera:flexnet_manager_suite scopes the issue to the FNMS web application, where account-settings administration is normally segregated between read-only viewers and Administrators. CWE-284 (Improper Access Control) indicates the suite fails to consistently enforce that role boundary on the server side: an action exposed to read-only users is missing an authorization check, so an account-settings viewer can invoke an administrative operation that promotes their own role. Because FNMS centrally controls licensing data, integrations to procurement/ITSM and connections to inventory sources, an Administrator-level identity has broad reach across the SAM control plane.

RemediationAI

Patch available per vendor advisory - consult Flexera's notice at https://community.flexera.com/s/feed/0D5PL00000rJX5K0AW for the fixed FNMS 2025 R1 build and apply it on the FNMS application server following standard change control. Until the update is deployed, audit and minimize the population of accounts that hold read-only access to account settings (the precondition for exploitation), revoke that role from users who do not actively need it, and rotate credentials for any account-settings users that are shared or stale; trade-off is administrative overhead and possible disruption to SAM reporting workflows. Additionally enable detailed audit logging on FNMS role-change and account-settings events and alert on any unexpected promotion to Administrator, and where feasible restrict the FNMS web UI to trusted management networks or VPN to shrink the network attack surface implied by the AV:N vector.