Log in Start free

Vulnerability · Published Mar 12, 2026 · Assigned by ProgressSoftware

CVE-2026-2514Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application

High 8.6

In plain English

A high-severity cross-site scripting in Flowmon ADS from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.2%top 92.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.

Affected products (as reported)

VendorProductVersions
Progress Software Flowmon ADS Flowmon ADS 12 versions prior to 12.5.5Flowmon ADS 13 versions prior to 13.0.3

Weakness: CWE-79 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

References