Vulnerability · Published Mar 12, 2026 · Assigned by ProgressSoftware
CVE-2026-2513Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon ADS web application
High 8.6
In plain English
A high-severity cross-site scripting in Flowmon ADS from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.2%top 93.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Flowmon ADS | Flowmon ADS 12 versions prior to 12.5.5Flowmon ADS 13 versions prior to 13.0.3 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N