CVE-2026-2514
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.
Risk Assessment
An attacker can exploit the administrator's browser to perform unauthorized actions, potentially compromising system and data integrity.
Recommendation
Update Progress Flowmon ADS to version 12.5.5 or 13.0.3 (or later). Restrict access to monitoring ports to trusted sources only.
Other vulnerabilities in Progress Flowmon ADS
See all- CVE-2026-9272High
In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability allows an authenticated low-privileged attacker to send specially crafted requests, potentially leading to unauthorized access and modification of application data.
- CVE-2026-2513Medium
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.
Original NVD description (English source)
In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS