CVE-2026-2514CWE-79cross-site-scripting

CVE-2026-2514

Medium · published March 12, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
8.2
In the wild
Unconfirmed
What it is

In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00190 · 8.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-12T17:16Z
Affected products (2)
ProductVersionsFixed in
progress/flowmon_anomaly_detection_system≥ 12.0.0, < 12.5.512.5.5
progress/flowmon_anomaly_detection_system≥ 13.0.0, ≤ 13.0.3—
References (1)
https://community.progress.com/s/article/CVE-2026-2514-Progress-Flowmon-ADS · [email protected]
EPSS history
Timeline
  • 12 MAR 13:00Z
    Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application
    cvelistv5