Loading story…
Progress released security updates for its Flowmon network performance and security monitoring platform to fix CVE-2024-2389, a critical vulnerability with a CVSS score of 10.0. The flaw affects Flowmon 11.x before 11.1.14 and 12.x before 12.3.5, while versions earlier than 11.0 are reported as not affected. According to the vendor notice and CSIRT.SK, the issue allows a remote, unauthenticated attacker to reach the Flowmon web management interface and execute arbitrary system commands through a specially crafted API request.
Successful exploitation could give an attacker unauthorized system access and enable malicious code execution, creating a path to full compromise of confidentiality, integrity, and availability on affected appliances. Organizations using Flowmon have been urged to immediately upgrade to 11.1.14, 12.3.5, or later, and to update all Flowmon plugins as part of remediation.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Progress released security updates for its Flowmon network performance and security monitoring platform to fix CVE-2024-2389, a critical unauthenticated remote code execution vulnerability with a CVSS score of 10. The flaw affects Flowmon 11.x before 11.1.14 and 12.x before 12.3.5, and users were advised to upgrade affected systems and plugins immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress disclosed two high-severity vulnerabilities in **Flowmon** that affect versions prior to **12.5.8**, with one issue also affecting versions prior to **13.0.6**. **CVE-2026-3692** is a `CWE-78` flaw that allows an authenticated low-privileged user to craft a request during report generation and trigger unintended command execution on the server, creating a path to compromise confidentiality, integrity, and availability without requiring user interaction. The second issue, **CVE-2026-2737**, is a `CWE-79` web-session attack in the Flowmon web application that can be triggered if an administrator clicks a malicious link supplied by an attacker. Progress said the flaw can cause unintended actions within the administrator’s authenticated session, exposing organizations to account misuse and broader system impact. The vulnerabilities were reported through Progress and documented in the vendor advisory portal, with affected customers urged to move to fixed releases **12.5.8** and **13.0.6** where applicable.
Jun 29, 2026
Threat actors are actively exploiting **CVE-2025-59528**, a **CVSS 10.0** remote code execution flaw in the open-source AI platform **Flowise**. The bug affects Flowise versions through **3.0.5** and stems from the `CustomMCP` node unsafely passing user-controlled input into JavaScript execution, allowing attackers with an API token to run arbitrary code with full **Node.js** runtime privileges. Researchers said the issue can be triggered remotely via a crafted HTTP `POST` request without user interaction, leading to operating system command execution, filesystem access, sensitive data theft, and full system compromise. Security researchers observed in-the-wild exploitation originating from a single **Starlink IP address**, while warning that roughly **12,000 to 15,000** internet-exposed Flowise instances sharply expand the attack surface for opportunistic attacks. Flowise disclosed the vulnerability in 2025, credited researcher **Kim SooHyun**, and patched the flaw in **version 3.0.6**. The incident marks the third Flowise vulnerability reported as exploited in the wild after **CVE-2025-8943** and **CVE-2025-26319**, increasing pressure on organizations to upgrade immediately and limit public exposure of Flowise APIs.
Jun 29, 2026
Flowise disclosed a critical remote code execution flaw, tracked as **`CVE-2026-56274`**, affecting versions before **`3.1.2`** in the Custom MCP Server feature. The vulnerability stems from multiple OS command injection paths in **`validateCommandFlags`** and **`validateArgsForLocalFileAccess`**, allowing attackers to configure a malicious MCP server and execute arbitrary commands on the Flowise host. The issue is rated **CVSS 9.9** and is remotely exploitable. Advisories describe three bypass techniques: an incomplete Docker argument blocklist that permits **`docker build`** with a remote URL, an **`npx`** blocklist bypass where **`--yes`** is allowed even though **`-y`** is blocked, and a Unix path validation weakness that lets paths beginning with **`//`** evade local file access checks for **`node`**. Exploitation requires any Flowise account role or API access with view and update permissions for chatflows. Organizations were urged to upgrade to **`Flowise 3.1.2`** or later, review MCP server configurations, and restrict chatflow management permissions.
Jun 29, 2026