Skip to main content

FlexNet Manager Suite EUVDEUVD-2026-38021

| CVE-2026-4027 HIGH
Improper Access Control (CWE-284)
2026-06-19 flexera GHSA-8vqp-qfpf-cm68
Authentication Bypass Flexnet Manager Suite
7.1
CVSS 4.0 · Vendor: flexera
Share

Severity by source

Vendor (flexera) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable web app, low complexity, any authenticated user (PR:L), no user interaction; broken object authorization discloses attachments so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (flexera).

CVSS VectorVendor: flexera

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 19, 2026 - 14:18 vuln.today

DescriptionCVE.org

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized access to attachment files due to insufficient access control.

AnalysisAI

Unauthorized attachment file access in Flexera FlexNet Manager Suite 2025 R1 and R2 allows authenticated low-privileged users to retrieve attachment files belonging to other tenants or users due to insufficient access control enforcement. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list, but the CVSS 4.0 base score of 7.1 reflects meaningful confidentiality impact over the network with low privileges required. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privileged FNMS account
Delivery
Authenticate to web/API
Exploit
Enumerate attachment object IDs
Execution
Send request for another user's attachment
Persist
Server returns document without ownership check
Impact
Exfiltrate sensitive license/contract data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires (1) network reachability to the FlexNet Manager Suite web application or API, (2) valid authenticated credentials at any privilege level (PR:L in the CVSS 4.0 vector - a guest or read-only SAM account is sufficient; anonymous attackers cannot exploit it), and (3) the target FNMS deployment running release 2025 R1 or 2025 R2 with attachment storage enabled and populated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Risk signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained any low-privileged FNMS account - for example via a stolen helpdesk credential, a contractor login, or insider abuse - authenticates to the web application and issues attachment-retrieval requests referencing object identifiers belonging to other users, organizations, or business units. Because the server checks only that the session is authenticated rather than that the principal owns the specific attachment, it returns the sensitive document (contracts, license keys, procurement evidence). …
Remediation Patch availability is per vendor advisory - consult Flexera's notice at https://community.flexera.com/s/feed/0D5PL00000ssjNi0AI for the specific fixed build for FNMS 2025 R1 and R2 and apply it on all FNMS application servers; no exact fix version is reproduced in the input data, so administrators should confirm the target build directly with Flexera support before rollout. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all deployed FNMS 2025 R1 and R2 instances and catalog user roles with attachment access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Flexnet Manager Suite

View all
CVE-2017-6885 CRITICAL
9.8 May 16

An error when handling certain external commands and services related to the FlexNet Inventory Agent and FlexNet Beacon

CVE-2026-4026 HIGH
8.7 Jun 19

Privilege escalation in Flexera FlexNet Manager Suite 2025 R1 allows an authenticated user holding only read-only access

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

EUVD-2026-38021 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy