CVE-2026-3692
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In Progress Flowmon versions prior to 12.5.8, an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.
Risk Assessment
The risk involves potential privilege escalation and arbitrary command execution, which could lead to full server compromise and data breach.
Recommendation
It is recommended to immediately upgrade Progress Flowmon to version 12.5.8 or later, which addresses this vulnerability.
Other vulnerabilities in Progress Flowmon
See all- CVE-2026-8079High
In Progress Flowmon versions prior to 12.5.9 and 13.0.11, an authenticated low-privileged user can craft a request during PDF generation, leading to operations performed with another user's privileges. This may result in unauthorized access to sensitive data and unintended system configuration changes.
- CVE-2026-2737Medium
A vulnerability in Progress Flowmon versions prior to 12.5.8 and 13.0.6 allows an attacker to trick an administrator into clicking a malicious link, potentially triggering unintended actions within their authenticated web session.
Original NVD description (English source)
In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.