CVE-2026-2737: Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web application
A vulnerability exists in Progress Flowmon versions prior to 12.5.8 and 13.0.6, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Flowmonto a version that resolves this vulnerability.Fixed in 12.5.8 - Upgrade
Upgrade
Progress Flowmonto a version that resolves this vulnerability.Fixed in 13.0.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2737?
CVE-2026-2737 is considered a medium severity vulnerability due to the potential for an administrator to unintentionally execute malicious actions.
How do I fix CVE-2026-2737?
To address CVE-2026-2737, upgrade Progress Flowmon to version 12.5.8 or 13.0.6, or later.
What versions of Progress Flowmon are affected by CVE-2026-2737?
Progress Flowmon versions prior to 12.5.8 and 13.0.6 are affected by CVE-2026-2737.
Can CVE-2026-2737 be exploited remotely?
Yes, CVE-2026-2737 can potentially be exploited remotely if an administrator clicks a malicious link.
What are the consequences of CVE-2026-2737 if exploited?
If exploited, CVE-2026-2737 may allow an attacker to perform unintended actions on behalf of the administrator.