PT-2026-29737 · Progress · Flowmon

Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-2737

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Progress Flowmon versions prior to 12.5.8 and versions prior to 13.0.6

Description A vulnerability exists where an administrator clicking a malicious link from an attacker could trigger unintended actions within their authenticated web session.

Recommendations Update to a version prior to 12.5.8. Update to a version prior to 13.0.6.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2737

Affected Products

Flowmon

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-2737 · Security Note
• https://community.progress.com/s/article/CVE-2026-2737-Progress-Flowmon · Vendor Advisory
• https://twitter.com/CVEnew/status/2039744350846869642 · Twitter Post