Loading story…
Progress disclosed two high-severity vulnerabilities in Flowmon that affect versions prior to 12.5.8, with one issue also affecting versions prior to 13.0.6. CVE-2026-3692 is a CWE-78 flaw that allows an authenticated low-privileged user to craft a request during report generation and trigger unintended command execution on the server, creating a path to compromise confidentiality, integrity, and availability without requiring user interaction.
The second issue, CVE-2026-2737, is a CWE-79 web-session attack in the Flowmon web application that can be triggered if an administrator clicks a malicious link supplied by an attacker. Progress said the flaw can cause unintended actions within the administrator’s authenticated session, exposing organizations to account misuse and broader system impact. The vulnerabilities were reported through Progress and documented in the vendor advisory portal, with affected customers urged to move to fixed releases 12.5.8 and 13.0.6 where applicable.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Public disclosure detailed two high-severity Flowmon vulnerabilities: CVE-2026-2737, a malicious-link web-session attack mapped to CWE-79, and CVE-2026-3692, a command execution flaw mapped to CWE-78. Both disclosures identified affected versions and described high potential impact to confidentiality, integrity, and availability.
Progress published a vendor advisory for CVE-2026-3692 on its community advisory portal. The vulnerability affects Flowmon versions prior to 12.5.8 and allows an authenticated low-privileged user to trigger unintended command execution during report generation.
Progress disclosed that vulnerability CVE-2026-2737, affecting Flowmon versions prior to 12.5.8 and 13.0.6, was received by security@progress.com. The flaw can let an attacker trigger unintended actions in an administrator's authenticated web session if the administrator clicks a malicious link.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress released security updates for its Flowmon network performance and security monitoring platform to fix **CVE-2024-2389**, a critical vulnerability with a **CVSS score of 10.0**. The flaw affects **Flowmon 11.x before 11.1.14** and **12.x before 12.3.5**, while versions earlier than 11.0 are reported as not affected. According to the vendor notice and CSIRT.SK, the issue allows a remote, unauthenticated attacker to reach the Flowmon web management interface and execute arbitrary system commands through a specially crafted API request. Successful exploitation could give an attacker unauthorized system access and enable malicious code execution, creating a path to full compromise of **confidentiality, integrity, and availability** on affected appliances. Organizations using Flowmon have been urged to immediately upgrade to **11.1.14**, **12.3.5**, or later, and to update all Flowmon plugins as part of remediation.
Jul 24, 2026
Progress disclosed two high-severity OS command injection vulnerabilities in its ADC product line, including **LoadMaster**, **ECS Connection Manager**, **Object Scale Connection Manager**, and **MOVEit WAF**. The issues, tracked as `CVE-2026-3517` and `CVE-2026-3519`, affect the API and can lead to remote code execution when authenticated administrators submit unsanitized input to specific commands. Both flaws are classified as `CWE-77` and carry a `CVSS v3.1` vector of `AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. `CVE-2026-3517` allows an attacker with **Geo Administration** permissions to exploit the `addcountry` command, while `CVE-2026-3519` requires **VS Administration** permissions to abuse the `aclcontrol` command. In both cases, Progress said arbitrary commands could be executed through the vulnerable API, and the vendor published an advisory covering these and related CVEs. Organizations using affected appliances should prioritize reviewing administrative access and applying vendor guidance to reduce exposure to authenticated abuse paths.
Jun 29, 2026
Progress Software disclosed five high-severity vulnerabilities affecting **LoadMaster**, **ECS Connection Manager**, **Connection Manager for ObjectScale**, **MOVEit WAF**, and, for one issue, **Multi-Tenant LoadMaster**. The flaws, tracked as `CVE-2026-59686` through `CVE-2026-59690`, include three authenticated OS command injection bugs and two authorization failures. `CVE-2026-59689` can let a low-privileged authenticated user escalate to **root**, while `CVE-2026-59690` allows unauthorized administrative actions through the **REST API**; the command injection issues (`CVE-2026-59686`, `CVE-2026-59687`, and `CVE-2026-59688`) affect the management interface, Geo Location management interface, and backup restore functionality, respectively. Progress said it has **no reports of active exploitation**, **no known direct customer impact**, and **no indicators of compromise** so far, but warned that successful exploitation could lead to full appliance compromise. The vulnerabilities carry **CVSS 3.1 scores of 8.0 to 8.4**, affect older product releases, and require authentication, prompting the vendor to urge immediate upgrades to fixed versions. Defenders are advised to tighten privileged account access, enforce strong authentication controls such as MFA where available, and closely monitor management interfaces and REST API activity for suspicious behavior.
Jul 29, 2026