An authenticated low‑privileged user can craft a request during report generation, causing the server to execute unintended commands. This OS command injection can give the attacker the ability to run arbitrary commands, leading to full compromise of confidentiality, integrity, and availability on the affected system. The vulnerability is catalogued as CWE‑78 and carries a CVSS score of 8.7, indicating a high severity.

Progress Software Flowmon versions older than 12.5.8 are vulnerable. The issue applies to all installations of Flowmon running any pre‑12.5.8 build, regardless of deployment size or environment.

The vulnerability is exploitable only by authenticated users with low privileges, but once accessed it can execute arbitrary server‑side commands. The EPSS shows a very low probability of exploitation (<1%) and it is not listed in CISA’s KEV catalog, suggesting no current widespread exploitation. Despite the low probability, the high impact warrants immediate attention, especially in environments where users can trigger report generation.