CVE-2026-2514
Last modified
CVE-2026-2514 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.
Metrics
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Flowmon ADS | Flowmon ADS 12 versions prior to 12.5.5; Flowmon ADS 13 versions prior to 13.0.3 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-2514?
How severe is CVE-2026-2514?
How do I fix CVE-2026-2514?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-25134Group-Office is an enterprise customer relationship manageme…8.8
- CVE-2026-25135OpenEMR is a free and open source electronic health records …4.5
- CVE-2026-25136Rucio is a software framework that provides functionality to…6.1
- CVE-2026-25137The NixOs Odoo package is an open source ERP and CRM system.…9.1
- CVE-2026-25138Rucio is a software framework that provides functionality to…5.3
- CVE-2026-25139RIOT is an open-source microcontroller operating system, des…9.1
- CVE-2026-25140apko allows users to build and publish OCI container images …7.5
- CVE-2026-25141Orval generates type-safe JS clients (TypeScript) from any v…9.8
- CVE-2026-25142SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2…10
- CVE-2026-25143melange allows users to build apk packages using declarative…7.8
- CVE-2026-25144Talishar is a fan-made Flesh and Blood project. A Stored XSS…5.3
- CVE-2026-25145melange allows users to build apk packages using declarative…5.5
Are you affected by CVE-2026-2514?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST