Vulnerability · Published Oct 9, 2025 · Assigned by ProgressSoftware
CVE-2025-10239Unintended command execution via troubleshooting scripts in Progress Flowmon
High 7.2
In plain English
A high-severity OS command injection in Flowmon from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.4%top 67.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Flowmon | Versions prior to 12.5.5 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://community.progress.com/s/article/CVE-2025-10239 vendor-advisory