Skip to content
OpenAdvisories
Medium · 6.7 CVE-2025-11906 EUVD-2025-36972GHSA-g429-pfpf-366c

Privilege escalation via writable configuration files in Progress Flowmon

Published Oct 30, 2025 · Updated Feb 26, 2026 · Assigned by ProgressSoftware

Description

A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization.

Affected products

VendorProductAffectedFixed
Progress Software Flowmon Flowmon 12 versions prior to 12.5.6 —

References