CVE-2026-2514: falha de alta gravidade em Progress Software Flowmon ADS
Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.2%
In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
Produtos afetados
Progress Software · Flowmon ADSCVEs relacionadas — Progress Software Flowmon ADS
No mesmo produto, das mais perigosas para as menos.
CVE-2025-13774HIGHSQL injection leading to privilege escalation in Progress Flowmon ADSEPSS 0.5%CVE-2026-9272HIGHPossibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADSEPSS 0.4%CVE-2026-2513HIGHPossibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon ADS web applicationEPSS 0.2%