CVE-2026-2514

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2514", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-02-14T09:56:25.024Z", "datePublished": "2026-03-12T13:00:27.353Z", "dateUpdated": "2026-03-13T03:55:43.039Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-03-12T13:00:27.353Z"}, "title": "Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "Progress Software", "product": "Flowmon ADS", "versions": [{"status": "affected", "version": "Flowmon ADS 12 versions prior to 12.5.5", "versionType": "custom"}, {"status": "affected", "version": "Flowmon ADS 13 versions prior to 13.0.3", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context."}]}], "references": [{"url": "https://community.progress.com/s/article/CVE-2026-2514-Progress-Flowmon-ADS", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-2514"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T03:55:43.039Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2514", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-12T14:07:48.523648Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:07:52.897Z"}}], "cna": {"title": "Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software", "product": "Flowmon ADS", "versions": [{"status": "affected", "version": "Flowmon ADS 12 versions prior to 12.5.5", "versionType": "custom"}, {"status": "affected", "version": "Flowmon ADS 13 versions prior to 13.0.3", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://community.progress.com/s/article/CVE-2026-2514-Progress-Flowmon-ADS", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.", "supportingMedia": [{"type": "text/html", "value": "In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-03-12T13:00:27.353Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2514", "state": "PUBLISHED", "dateUpdated": "2026-03-12T14:08:01.579Z", "dateReserved": "2026-02-14T09:56:25.024Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2026-03-12T13:00:27.353Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Flowmon ADS", "vendor": "Progress Software", "versions": [{"status": "affected", "version": "Flowmon ADS 12 versions prior to 12.5.5", "versionType": "custom"}, {"status": "affected", "version": "Flowmon ADS 13 versions prior to 13.0.3", "versionType": "custom"}]}], "source": "security@progress.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:progress:flowmon_anomaly_detection_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "405CD3FC-2352-433E-9CE1-64C4D42FE901", "versionEndExcluding": "12.5.5", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:progress:flowmon_anomaly_detection_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "F254E72E-0D9C-4DA3-8C45-30A9109397A2", "versionEndIncluding": "13.0.3", "versionStartIncluding": "13.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context."}, {"lang": "es", "value": "En las versiones de Progress Flowmon ADS anteriores a la 12.5.5 y la 13.0.3, existe una vulnerabilidad por la cual un adversario con acceso a los puertos de monitoreo de Flowmon podr\u00eda crear datos de red maliciosos que, al ser procesados por Flowmon ADS y visualizados por un usuario autenticado, podr\u00edan resultar en acciones no deseadas siendo ejecutadas en el contexto del navegador del usuario."}], "id": "CVE-2026-2514", "lastModified": "2026-09-03T17:34:02.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@progress.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2514", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-12T13:16:14.203", "references": [{"source": "security@progress.com", "tags": ["Vendor Advisory"], "url": "https://community.progress.com/s/article/CVE-2026-2514-Progress-Flowmon-ADS"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@progress.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,12.5.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,13.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Flowmon ADS", "source": "cna", "vendor": "Progress Software"}, "product": "flowmon_ads", "vendor": "progress_software"}], "analysis": {"en": {"generated_at": "2026-03-18T14:44:42.434191+00:00", "value": {"mitigation_remediation": ["Upgrade Flowmon ADS to version 12.5.5 or later for the 12.x line, or to 13.0.3 or later for the 13.x line.", "Restrict access to the Flowmon monitoring ports to trusted networks or authorised personnel only.", "If a patch cannot be applied immediately, disable or restrain the viewing of network data for authenticated users until the vulnerability is remediated."], "summary": {"action": "Patch ASAP", "impact": "Unintended Browser Actions"}, "threat_synthesis": {"affected_systems": "The issue affects Progress Software Flowmon ADS versions prior to 12.5.5 and 13.0.3. Any deployed instance using those versions is susceptible; newer releases contain the fix.", "description_and_impact": "A flaw in Progress Flowmon ADS allows maliciously crafted network data to be processed by the application and, when viewed by an authenticated user, can trigger unintended actions within the user's browser context. The vulnerability is a form of client\u2011side code injection, relating to the CWE\u201179 (XSS) weakness reported by the vendor.", "risk_and_exploitability": "The CVSS score of 8.6 indicates high severity. EPSS is listed as <1%, implying a low but non\u2011zero probability of exploitation in the wild, and the vulnerability is not catalogued in CISA's KEV. An attacker must have access to the Flowmon monitoring ports to craft the malicious payload, and the victim must be an authenticated user who opens the affected data in a web browser. Although the exploitation vector is relatively narrow, the impact is significant due to the potential for arbitrary JavaScript execution in the user's context."}}}}, "created": "2026-03-13T09:53:11.935454+00:00", "updated": "2026-03-20T15:49:48.971261+00:00", "vendors": ["progress_software", "progress_software$PRODUCT$flowmon_ads"]}