CVE-2026-8079: flowmon from 12.0.0 (inclusive), before 12.5.9 (exclusive), from 13.0.0 (inclusive), before 13.0.11 (exclusive); +1…

Affected technology

flowmon · from 12.0.0 (inclusive), before 12.5.9 (exclusive)
progress

flowmon · from 13.0.0 (inclusive), before 13.0.11 (exclusive)
progress

Flowmon · Flowmon 12 versions prior to 12.5.9, Flowmon 13 versions prior to 13.0.11
Progress Software

Description’s affected range: versions prior to 12.5.9 and 13.0.11

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized access to sensitive data and unintended modifications to system configuration. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as high; availability impact as low.