What’s Vulnerable › Vulnerabilities

CVE-2025-11906: Privilege escalation via writable configuration files in Progress Flowmon

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-30 · updated 2026-10-08
• Weakness: CWE-732

Description

A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization.

Affected products

• Progress Software Flowmon: from Flowmon 12 versions prior through 12.5.6

References

• https://community.progress.com/s/article/Progress-Flowmon-CVE-2025-11906

Get alerted when CVE-2025-11906 or the next vulnerability affects your stack