EUVD-2026-41375
GHSA-m362-439h-2w4j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with only a low-privileged account and no user interaction (AV:N/AC:L/PR:L/UI:N); confused-deputy authorization flaw yields high confidentiality and integrity impact with limited availability effect.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
In Progress Flowmon versions prior to 12.5.9 and 13.0.10, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized access to sensitive data and unintended modifications to system configuration.
AnalysisAI
Privilege escalation via incorrect authorization in Progress Flowmon lets an authenticated low-privileged user abuse the PDF generation workflow to have operations executed under another user's identity, exposing sensitive data and permitting unauthorized configuration changes. It affects all Flowmon releases before 12.5.9 (12.x branch) and before 13.0.10 (13.x branch). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor CVSS 4.0 score is 8.7 (High).
Technical ContextAI
Flowmon is Progress Software's network performance monitoring, diagnostics, and network detection & response (NDR) appliance/platform, identified in CPE as cpe:2.3:a:progress_software:flowmon. The flaw is classed as CWE-863 (Incorrect Authorization): the application performs an authorization check that is present but implemented incorrectly, so a request crafted during PDF report generation is evaluated in the security context of a different (higher-privileged) user. This is a classic 'confused deputy' pattern where a trusted server-side process acts on attacker-supplied input without correctly binding the operation to the requesting user's own privileges, allowing the low-privileged caller to inherit another user's effective permissions.
RemediationAI
Upgrade to a fixed release: Flowmon 12.5.9 or later on the 12.x branch, or 13.0.10 or later on the 13.x branch, per the vendor advisory at https://community.progress.com/s/article/Flowmon-CVE-2026-8079 (Vendor-released patch: 12.5.9 / 13.0.10). Until patching is complete, reduce exposure by tightening account provisioning - remove or downgrade unnecessary low-privileged accounts and enforce least privilege, since exploitation requires an authenticated session; restrict network access to the Flowmon management interface to trusted administrative networks/VPN to limit who can reach the PDF generation endpoint; and, if operationally acceptable, limit or monitor use of the report/PDF export functionality (trade-off: users lose self-service reporting). These are compensating controls only and do not remove the underlying authorization flaw; the upgrade is the definitive fix.
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Progress Flowmon versions prior to 12.5.8 allow authenticated low-privileged users to execute arbitrary commands on the
Progress Flowmon 12.x and 13.0.x contain a cross-site scripting (XSS) vulnerability allowing authenticated attackers to
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today