Search
Find a vulnerability
Search criteria
2 vulnerabilities found for FlexNet Beacon by Flexera
CVE-2026-110390 (GCVE-0-2026-110390)
Vulnerability from nvd – Published: 2026-11-05 22:32 – Updated: 2026-11-10 14:01
VLAI
EPSS
VEX
Title
FlexNet Beacon Missing Authentication Vulnerability
Summary
Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:01 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://community.flexera.com/s/article/Flexera-B… | vendor-advisory |
| https://community.flexera.com/s/article/Flexera-B… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Flexera | FlexNet Beacon |
Affected:
0 , < 26.4.1
(custom)
|
|
| Flexera | FlexNet Manager Suite |
Affected:
2026 R1 , < 2026 R2
(custom)
Affected: 2025 R2 , < 2026 R1 (custom) Affected: 2025 R1 , < 2025 R2 (custom) Affected: 0 , < 2025 R1 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110390",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:01:05.369765Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:01:17.593Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexNet Beacon",
"vendor": "Flexera",
"versions": [
{
"lessThan": "26.4.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"FlexNet Beacon"
],
"platforms": [
"Windows"
],
"product": "FlexNet Manager Suite",
"vendor": "Flexera",
"versions": [
{
"changes": [
{
"at": "2026 R1 IOK-2107311",
"status": "unaffected"
}
],
"lessThan": "2026 R2",
"status": "affected",
"version": "2026 R1",
"versionType": "custom"
},
{
"changes": [
{
"at": "2025 R2 IOK-2107311",
"status": "unaffected"
}
],
"lessThan": "2026 R1",
"status": "affected",
"version": "2025 R2",
"versionType": "custom"
},
{
"changes": [
{
"at": "2025 R1 IOK-2107311",
"status": "unaffected"
}
],
"lessThan": "2025 R2",
"status": "affected",
"version": "2025 R1",
"versionType": "custom"
},
{
"lessThan": "2025 R1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eMissing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).\u003c/div\u003e"
}
],
"value": "Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default)."
}
],
"impacts": [
{
"capecId": "CAPEC-87",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-87 Forceful Browsing"
}
]
},
{
"capecId": "CAPEC-169",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-169 Footprinting"
}
]
},
{
"capecId": "CAPEC-309",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-309 Network Topology Mapping"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497 Exposure of sensitive system information to an unauthorized control sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:32:44.772Z",
"orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"shortName": "flexera"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.flexera.com/s/article/Flexera-Beacon-Security-Advisory-CVE-2026-110390"
},
{
"tags": [
"patch"
],
"url": "https://community.flexera.com/s/article/Flexera-Beacon-security-hotfix-IOK-2107311"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "FlexNet Beacon Missing Authentication Vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"assignerShortName": "flexera",
"cveId": "CVE-2026-110390",
"datePublished": "2026-11-05T22:32:44.772Z",
"dateReserved": "2026-10-14T01:08:02.713Z",
"dateUpdated": "2026-11-10T14:01:17.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110390 (GCVE-0-2026-110390)
Vulnerability from cvelistv5 – Published: 2026-11-05 22:32 – Updated: 2026-11-10 14:01
VLAI
EPSS
VEX
Title
FlexNet Beacon Missing Authentication Vulnerability
Summary
Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:01 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://community.flexera.com/s/article/Flexera-B… | vendor-advisory |
| https://community.flexera.com/s/article/Flexera-B… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Flexera | FlexNet Beacon |
Affected:
0 , < 26.4.1
(custom)
|
|
| Flexera | FlexNet Manager Suite |
Affected:
2026 R1 , < 2026 R2
(custom)
Affected: 2025 R2 , < 2026 R1 (custom) Affected: 2025 R1 , < 2025 R2 (custom) Affected: 0 , < 2025 R1 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110390",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:01:05.369765Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:01:17.593Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexNet Beacon",
"vendor": "Flexera",
"versions": [
{
"lessThan": "26.4.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"FlexNet Beacon"
],
"platforms": [
"Windows"
],
"product": "FlexNet Manager Suite",
"vendor": "Flexera",
"versions": [
{
"changes": [
{
"at": "2026 R1 IOK-2107311",
"status": "unaffected"
}
],
"lessThan": "2026 R2",
"status": "affected",
"version": "2026 R1",
"versionType": "custom"
},
{
"changes": [
{
"at": "2025 R2 IOK-2107311",
"status": "unaffected"
}
],
"lessThan": "2026 R1",
"status": "affected",
"version": "2025 R2",
"versionType": "custom"
},
{
"changes": [
{
"at": "2025 R1 IOK-2107311",
"status": "unaffected"
}
],
"lessThan": "2025 R2",
"status": "affected",
"version": "2025 R1",
"versionType": "custom"
},
{
"lessThan": "2025 R1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eMissing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).\u003c/div\u003e"
}
],
"value": "Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default)."
}
],
"impacts": [
{
"capecId": "CAPEC-87",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-87 Forceful Browsing"
}
]
},
{
"capecId": "CAPEC-169",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-169 Footprinting"
}
]
},
{
"capecId": "CAPEC-309",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-309 Network Topology Mapping"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497 Exposure of sensitive system information to an unauthorized control sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:32:44.772Z",
"orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"shortName": "flexera"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.flexera.com/s/article/Flexera-Beacon-Security-Advisory-CVE-2026-110390"
},
{
"tags": [
"patch"
],
"url": "https://community.flexera.com/s/article/Flexera-Beacon-security-hotfix-IOK-2107311"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "FlexNet Beacon Missing Authentication Vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"assignerShortName": "flexera",
"cveId": "CVE-2026-110390",
"datePublished": "2026-11-05T22:32:44.772Z",
"dateReserved": "2026-10-14T01:08:02.713Z",
"dateUpdated": "2026-11-10T14:01:17.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}