Read the docs
TI-2026-85707 Aliases CVE-2026-110390GHSA-gvx3-5xrq-vr57

FlexNet Beacon Missing Authentication Vulnerability

Priority LOW 31CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-497.

Summary

Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).

Why it matters now

EPSS 0.00408 35th percentileScored 2026-11-07
Fix Fixed FlexNet Beacon (Flexera): 26.4.1FlexNet Manager Suite (Flexera): 2026 R2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
FlexeraFlexNet Beaconbefore 26.4.126.4.1Patch availableCNA
FlexeraFlexNet Manager Suite2026 R1 to before 2026 R2; 2025 R2 to before 2026 R1; 2025 R1 to before 2025 R2; before 2025 R12026 R2Patch availableCNA
  • FlexNet Beacon VendorFlexera Affected before 26.4.1 Fixed in 26.4.1 Patch available CNA
  • FlexNet Manager Suite VendorFlexera Affected 2026 R1 to before 2026 R2; 2025 R2 to before 2026 R1; 2025 R1 to before 2025 R2; before 2025 R1 Fixed in 2026 R2 Patch available CNA

Remediation

  • Fix · CNA FlexNet Beacon (Flexera) Fixed in 26.4.1
  • Fix · CNA FlexNet Manager Suite (Flexera) Fixed in 2026 R2

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-110390
  2. 2026-11-06 Alias added: GHSA-gvx3-5xrq-vr57
  3. 2026-11-07 Priority changed: MEDIUM → LOW

References

Patch 1

Advisory 1

  • TI-2026-68945 Authentication bypass in FlexNet Publisher lmadmin SOAP handler CVSS 4.0CRITICAL 9.3
  • TI-2018-14211 Resource allocation without limits in Flexera Software LLC FlexNet Publisher CVSS 3.1CRITICAL 9.8
  • TI-2026-03488 FlexNet Manager Suite Privilege Escalation Vulnerability CVSS 4.0HIGH 8.7
  • TI-2021-18267 2FA bypass on the RISC Platform CVSS 4.0LOW 2.3
  • TI-2020-09734 An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x… CVSS 3.1CRITICAL 9.9
  • TI-2024-02473 Local privilege escalation in FlexNet Publisher CVSS 4.0HIGH 8.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences