Progress Flowmon EUVD-2026-41375

Requires an authenticated, low-privileged Flowmon user account (CVSS PR:L) with access to the report/PDF generation functionality; the malicious request must be crafted specifically during the PDF generation process, which is the exact feature that mis-attributes the operation to another user. Exploitation is network-reachable with no user interaction and low complexity (AV:N/AC:L/AT:N/UI:N), but is limited by the need for valid credentials on an affected version (below 12.5.9 or 13.0.10) and by reachability of the Flowmon management interface - it is not exploitable by a fully unauthenticated attacker.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality and integrity impact - a credible priority for any environment where Flowmon accounts are broadly provisioned, since any authenticated low-tier user is a potential attacker. Offsetting the high CVSS: exploitation is gated by valid authentication (PR:L), there is no public exploit identified and no CISA KEV listing, and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation at this time. The realistic risk profile is that of an insider/post-compromise privilege-escalation primitive rather than an unauthenticated internet-wide threat; treat it as high priority to patch on multi-tenant or many-user Flowmon deployments and moderate where console access is tightly restricted.

A low-privileged Flowmon user who can log in to the console submits a specially crafted request through the PDF report generation flow so that the backend performs the operation under a higher-privileged user's context, returning data or applying configuration changes the attacker is not entitled to. No public proof-of-concept is available, but the low attack complexity and lack of required user interaction (AC:L/UI:N) mean a valid account is the main prerequisite.