Read the docs
TI-2026-03489 Aliases CVE-2026-4027GHSA-8vqp-qfpf-cm68

FlexNet Manager Suite Attachment File Disclosure

Priority LOW 37CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized access to attachment files due to insufficient access control.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix Fixed FlexNet Manager Suite (Flexera): 2026 R1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FlexeraFlexNet Manager Suite2025 R1 – 2025 R22026 R1Patch availableCNA
  • FlexNet Manager Suite VendorFlexera Affected 2025 R1 – 2025 R2 Fixed in 2026 R1 Patch available CNA

Remediation

  • Fix · CNA FlexNet Manager Suite (Flexera) Fixed in 2026 R1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4027
  2. 2026-10-03 Alias added: GHSA-8vqp-qfpf-cm68

References

Advisory 1

  • TI-2026-68945 Authentication bypass in FlexNet Publisher lmadmin SOAP handler CVSS 4.0CRITICAL 9.3
  • TI-2018-14211 Resource allocation without limits in Flexera Software LLC FlexNet Publisher CVSS 3.1CRITICAL 9.8
  • TI-2026-03488 FlexNet Manager Suite Privilege Escalation Vulnerability CVSS 4.0HIGH 8.7
  • TI-2021-18267 2FA bypass on the RISC Platform CVSS 4.0LOW 2.3
  • TI-2020-09734 An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x… CVSS 3.1CRITICAL 9.9
  • TI-2024-02473 Local privilege escalation in FlexNet Publisher CVSS 4.0HIGH 8.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences