Which versions of Flowmon ADS are affected by CVE-2026-9272?

Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5 contain a SQL injection vulnerability allowing low-privileged authenticated users to read and modify critical network monitoring data.

How to fix or mitigate CVE-2026-9272?

24 hours: Audit all Flowmon ADS deployments and identify versions before 12.5.6 and 13.0.5. 7 days: Restrict administrative access to Flowmon, enforce multi-factor authentication for all Flowmon accounts, and implement SQL injection detection monitoring on database query logs. 30 days: Obtain patch timeline from Progress Software; evaluate upgrade to versions 12.5.6 or 13.0.5 or later; maintain compensating controls until patch deployment.

Flowmon ADS CVE-2026-9272

Q: What is the CVSS score of CVE-2026-9272?

CVE-2026-9272 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41374 HIGH

SQL Injection (CWE-89)

2026-07-02 ProgressSoftware

GHSA-99jj-h9fr-3fxx

Authentication Bypass SQLi Flowmon Ads Progress Software

8.7

CVSS 4.0 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable low-complexity SQLi needing only a low-privileged account (PR:L, AC:L, AV:N); High C/I from confirmed data read and modification, A:H retained to match vendor availability rating.

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 14:45 vuln.today

DescriptionCVE.org

In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to application data and its modification.

AnalysisAI

SQL injection in Progress Flowmon ADS (Anomaly Detection System) before versions 12.5.6 and 13.0.5 allows a low-privileged authenticated user to read and modify application data by sending specially crafted requests. The CVSS 4.0 base score of 8.7 (High) reflects high confidentiality and integrity impact plus availability impact over the network with only low privileges required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Flowmon ADS is the Anomaly Detection System module of Progress Flowmon, a network detection and response (NDR) / network performance monitoring appliance that ingests flow telemetry (NetFlow/IPFIX) to detect behavioral anomalies. The single affected product is identified by the CPE cpe:2.3:a:progress_software:flowmon_ads:*:*:*:*:*:*:*:*. The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated into database queries without proper parameterization or sanitization, enabling an attacker to alter query logic. The vendor tags additionally reference 'Authentication Bypass' alongside 'SQLi', suggesting the injection may permit access to data or actions beyond the attacker's assigned role, though the exact mechanism is not detailed in the advisory.

RemediationAI

Vendor-released patch: upgrade to Flowmon ADS 12.5.6 (for 12.x deployments) or 13.0.5 (for 13.x deployments) or later, as directed in the Progress advisory at https://community.progress.com/s/article/Flowmon-CVE-2026-9272. Because exploitation requires an authenticated low-privileged account, interim compensating controls until patching include tightening account provisioning - remove or disable unnecessary low-privilege ADS user accounts, enforce strong authentication, and audit existing accounts for unexpected access. Restrict network reachability of the ADS management/web interface to trusted administrative networks or a management VLAN so that only authorized operators can reach the vulnerable request endpoints, accepting the trade-off that legitimate remote administrators must connect via VPN/bastion. Increase monitoring of ADS application and database logs for anomalous query patterns or unexpected data changes. Confirm exact fixed build availability for your branch directly with Progress before scheduling the upgrade.