Medium severity · published Mar 12, 2026
CVE-2026-2514
Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
Flowmon ADS · Progress Software
Flowmon ADS 12 versions prior to 12.5.5; Flowmon ADS 13 versions prior to 13.0.3 · source: vendor
FA
Flowmon Anomaly Detection System · Progress
12.0.0 before 12.5.5; 13.0.0 through 13.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2514
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2514
Vendor Advisory
https://community.progress.com/s/article/CVE-2026-2514-Progress-Flowmon-ADS
More from Flowmon ADS
8.1
CVE-2026-9272
Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS
6.1
CVE-2026-2513
Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon ADS web application