CVE-2026-9272: Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS
In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to application data and its modification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Flowmon ADSto a version that resolves this vulnerability.Fixed in 12.5.6 - Upgrade
Upgrade
Progress Flowmon ADSto a version that resolves this vulnerability.Fixed in 13.0.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9272?
CVE-2026-9272 has a high severity rating of 8.7 on the CVSS scale.
How do I fix CVE-2026-9272?
To fix CVE-2026-9272, upgrade to Progress Flowmon ADS version 12.5.6 or 13.0.5 or later.
What type of vulnerability is CVE-2026-9272?
CVE-2026-9272 is a SQL Injection vulnerability that can lead to unauthorized access to application data.
Who is affected by CVE-2026-9272?
CVE-2026-9272 affects users of Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5.
What can an attacker do with CVE-2026-9272?
An attacker authenticated as a low-privileged user can send specially crafted requests that may inadvertently trigger unintended database operations.