Critical severity · published Oct 7, 2026
CVE-2026-19572
FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability
9.3
CVSS
0.4%
EPSS
No
On KEV
Description
A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FP
FlexNet Publisher · Flexera
through 11.19.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19572
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19572
community.revenera.com
https://community.revenera.com/s/article/CVE202619572-FlexNet-Publisher-lmadmin-SOAP-Authentication-Bypass-Vulnerability
More from FlexNet Publisher
9.8
CVE-2018-20033
A Remote Code Execution vulnerability in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier could allow a remote attacker to corrupt the memory…
8.5
CVE-2024-2658
Local privilege escalation in FlexNet Publisher
7.5
CVE-2019-8963
A Denial of Service (DoS) vulnerability was discovered in FlexNet Publisher's lmadmin 11.16.5, when doing a crafted POST request on lmadmin using the web-based tool
7.5
CVE-2020-12080
A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6
7.5
CVE-2020-12081
An information disclosure vulnerability has been identified in FlexNet Publisher lmadmin.exe 11.14.0.2