CVE-2026-2514: fallo de gravedad alta en Progress Software Flowmon ADS
Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.6epss 0.2%
In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
Productos afectados
Progress Software · Flowmon ADSCVEs relacionadas — Progress Software Flowmon ADS
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-13774HIGHSQL injection leading to privilege escalation in Progress Flowmon ADSEPSS 0.5%CVE-2026-9272HIGHPossibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADSEPSS 0.4%CVE-2026-2513HIGHPossibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon ADS web applicationEPSS 0.2%