CVE-2026-2098: Flowring｜AgentFlow - Reflected Cross-site Scripting

Q: What is the severity of CVE-2026-2098?

CVE-2026-2098 is considered a high severity vulnerability due to the potential for unauthenticated remote attackers to execute arbitrary JavaScript in a user's browser.

Q: How do I fix CVE-2026-2098?

To fix CVE-2026-2098, apply the latest security patches provided by Flowring for the AgentFlow software.

Q: Who is affected by CVE-2026-2098?

Any user of the Flowring AgentFlow software is potentially affected by CVE-2026-2098 if they have not mitigated this vulnerability.

Q: What type of vulnerability is CVE-2026-2098?

CVE-2026-2098 is classified as a reflected cross-site scripting (XSS) vulnerability.

Q: What impact can CVE-2026-2098 have on users?

CVE-2026-2098 can lead to unauthorized access and manipulation of user sessions, making users susceptible to phishing attacks.

Published Feb 10, 2026

Updated

AgentFlow developed by Flowring has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

Affected Software

2 affected components

Flowring Agentflow

Flowring Agentflow<4.0.0.1878.877

Remediation

Information

Update to version 4.0.0.1878.877 or later.

Event History

Feb 10, 2026

CVE Published

via MITRE·07:06 AM

Data Sourced

via MITRE·07:06 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-2098?

CVE-2026-2098 is considered a high severity vulnerability due to the potential for unauthenticated remote attackers to execute arbitrary JavaScript in a user's browser.

How do I fix CVE-2026-2098?