A remote code execution flaw exists in the FlexNet Publisher lmadmin web user interface that lets an attacker run arbitrary code on the host running the web service. By exploiting this weakness the attacker could gain full control of the system, potentially compromising all sensitive data and disrupting operations. The vulnerability aligns with CWE‑829, indicating that privileged functions are improperly exposed to external callers.

Revera’s FlexNet Publisher product is affected. Any deployment of FlexNet Publisher in a version released before 2023 R2 (11.19.4.0) remains vulnerable; newer releases contain the vendor‑supplied fix.

The CVSS score of 8.6 marks this issue as high severity. EPSS data is not available, so the current probability of exploitation cannot be quantified, and the flaw is not listed in CISA’s KEV catalog. The CVE description confirms that an attacker can exploit the flaw remotely through the lmadmin web interface, meaning that network access to the management console is required to launch an attack.