Which versions of FlexNet Manager Suite are affected by CVE-2026-4027?

Flexera FlexNet Manager Suite 2025 R1 and R2 contains an access control weakness that enables low-privileged users to access sensitive attachment files across organizational boundaries.

How to fix or mitigate CVE-2026-4027?

Within 24 hours: Identify all deployed FNMS 2025 R1 and R2 instances and catalog user roles with attachment access. Within 7 days: Restrict low-privileged user permissions to read-only or remove attachment access entirely where possible; audit file access logs for unauthorized cross-tenant retrievals. Within 30 days: Implement network segmentation limiting FNMS access to corporate networks, establish continuous audit logging for attachment operations, and establish a vendor escalation plan with Flexera support for patch availability tracking.

FlexNet Manager Suite CVE-2026-4027

Q: What is the CVSS score of CVE-2026-4027?

CVE-2026-4027 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38021 HIGH

Improper Access Control (CWE-284)

2026-06-19 flexera

GHSA-8vqp-qfpf-cm68

Authentication Bypass Flexnet Manager Suite Flexera

7.1

CVSS 4.0 · Vendor: flexera

Severity by source

Vendor (flexera) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable web app, low complexity, any authenticated user (PR:L), no user interaction; broken object authorization discloses attachments so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (flexera).

CVSS VectorVendor: flexera

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:18 vuln.today

DescriptionCVE.org

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized access to attachment files due to insufficient access control.

AnalysisAI

Unauthorized attachment file access in Flexera FlexNet Manager Suite 2025 R1 and R2 allows authenticated low-privileged users to retrieve attachment files belonging to other tenants or users due to insufficient access control enforcement. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list, but the CVSS 4.0 base score of 7.1 reflects meaningful confidentiality impact over the network with low privileges required. Organizations using FNMS for software asset management and license compliance should review the Flexera Community advisory and apply vendor guidance.

Technical ContextAI

FlexNet Manager Suite (FNMS) is Flexera's enterprise software asset management (SAM) platform used to track license entitlements, software inventory, and compliance attachments such as contracts, proof-of-purchase documents, and entitlement evidence. The flaw maps to CWE-284 (Improper Access Control), which means the application authorizes a request based on the user's authenticated session but fails to verify whether the requesting principal is permitted to access the specific attachment object - a classic broken object-level authorization (BOLA / IDOR-class) weakness at the document-retrieval layer. The affected CPE cpe:2.3:a:flexera:flexnet_manager_suite covers the 2025 R1 and R2 release lines of the on-premise / hosted FNMS application.

RemediationAI

Patch availability is per vendor advisory - consult Flexera's notice at https://community.flexera.com/s/feed/0D5PL00000ssjNi0AI for the specific fixed build for FNMS 2025 R1 and R2 and apply it on all FNMS application servers; no exact fix version is reproduced in the input data, so administrators should confirm the target build directly with Flexera support before rollout. Until the patch is deployed, compensating controls include restricting FNMS web UI and API access to trusted management networks via firewall or reverse-proxy ACLs (trade-off: blocks remote-worker self-service), tightening role assignments so that only the minimum number of users hold accounts capable of reaching attachment endpoints (trade-off: may delay routine SAM workflows), and enabling and reviewing FNMS access logs for unexpected attachment-download patterns indexed by user-to-object pairings (trade-off: detection only, no prevention).