High severity · published Jul 2, 2026
CVE-2026-8079
Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized access to sensitive data and unintended modifications to system configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flowmon · Progress Software
Flowmon 12 versions prior to 12.5.9; Flowmon 13 versions prior to 13.0.11 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8079
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8079
Vendor Advisory
https://community.progress.com/s/article/Flowmon-CVE-2026-8079
More from Flowmon
8.8
CVE-2026-3692
Unintended command execution during report generation in Progress Flowmon
6.1
CVE-2026-2737
Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web application