CVE-2026-9272

In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to application data and its modification.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://community.progress.com/s/article/Flowmon-CVE-2026-9272	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:progress:flowmon_anomaly_detection_system::::::::
	cpe:2.3:a:progress:flowmon_anomaly_detection_system::::::::

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En las versiones de Progress Flowmon ADS anteriores a la 12.5.6 y 13.0.5, existe una vulnerabilidad por la cual un adversario que está autenticado como un usuario con privilegios bajos en el Sistema de Detección de Anomalías (ADS) puede enviar solicitudes especialmente diseñadas que podrían resultar en acceso no autorizado a los datos de la aplicación y su modificación.

Information

Published : 2026-07-02 15:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-9272

Mitre link : CVE-2026-9272

CVE.ORG link : CVE-2026-9272

JSON object : View

Products Affected

progress

flowmon_anomaly_detection_system

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-9272", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9272", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-02T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "Flowmon ADS", "versions": [{"status": "affected", "version": "Flowmon ADS 12 versions prior to 12.5.6", "versionType": "custom"}, {"status": "affected", "version": "Flowmon ADS 13 versions prior to 13.0.5", "versionType": "custom"}], "defaultStatus": "affected"}]}], "published": "2026-07-02T15:17:11.937", "references": [{"url": "https://community.progress.com/s/article/Flowmon-CVE-2026-9272", "tags": ["Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to application data and its modification."}, {"lang": "es", "value": "En las versiones de Progress Flowmon ADS anteriores a la 12.5.6 y 13.0.5, existe una vulnerabilidad por la cual un adversario que est\u00e1 autenticado como un usuario con privilegios bajos en el Sistema de Detecci\u00f3n de Anomal\u00edas (ADS) puede enviar solicitudes especialmente dise\u00f1adas que podr\u00edan resultar en acceso no autorizado a los datos de la aplicaci\u00f3n y su modificaci\u00f3n."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:flowmon_anomaly_detection_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60D0F762-0F40-4B9A-A149-497183BB45DB", "versionEndExcluding": "12.5.6", "versionStartIncluding": "12.5.0"}, {"criteria": "cpe:2.3:a:progress:flowmon_anomaly_detection_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B087230-F276-4512-8098-77C8587E0C63", "versionEndExcluding": "13.0.5", "versionStartIncluding": "13.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}